PT-2025-42390 · Frigate · Frigate

Published 2025-10-15 · Updated 2025-10-16 · CVE-2025-62382

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Frigate versions prior to 0.16.2

Description Frigate, a network video recorder with real-time object detection for IP cameras, contains a flaw in its export workflow. Before version 0.16.2, an authenticated user could specify any filesystem location as the thumbnail source for video exports. This path is then copied to the publicly accessible clips directory, allowing the reading of arbitrary files on the host system. This allows a low-privilege user with API access to potentially access sensitive configuration files, secrets, or user data. The issue arises from a violation of the principle of least privilege within the export subsystem. The exploitation involves a timing window during file copying before cleanup occurs.

Recommendations Update to Frigate version 0.16.2 or later.

Exploit

Fix

Weakness Enumeration

CWE-73

Related Identifiers

CVE-2025-62382

GHSA-8GV4-5JR9-V96J

Affected Products

Frigate

References · 9

• 🔥 https://github.com/blakeblackshear/frigate/security/advisories/GHSA-8gv4-5jr9-v96j · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62382.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-62382 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62382 · Security Note
• https://github.com/blakeblackshear/frigate/commit/d7f7cd7be16bfe7a12766b797da6b8add687ccd9 · Note
• https://twitter.com/CVEnew/status/1978545027581423819 · Twitter Post
• https://t.me/CVEtracker/35034 · Telegram Post
• https://twitter.com/CveTodo/status/1978528867737366706 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1978650507188052332 · Twitter Post