PT-2025-45521 · Intel · Cvat

Published 2025-11-07 · Updated 2025-11-08 · CVE-2025-64485

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions CVAT versions 2.4.0 through 2.48.1

Description CVAT is an interactive video and image annotation tool for computer vision. A user with the User global role can potentially create or overwrite files in the root of a mounted file share. If a file share is not mounted, files can be created in the import worker container's share directory, potentially consuming disk space.

Recommendations Update to version 2.49.0 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-64485

GHSA-X396-W86C-GF6W

Affected Products

Cvat

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64485.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-64485 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64485 · Vendor Advisory
• https://github.com/cvat-ai/cvat/security/advisories/GHSA-x396-w86c-gf6w · Note
• https://github.com/cvat-ai/cvat/commit/cace877189528a7ed4a224476f4bc0bd5a21d40c · Note
• https://t.me/CVEtracker/36823 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1987023248182169930 · Twitter Post
• https://twitter.com/CVEnew/status/1986939159982858243 · Twitter Post