CVE-2025-68430CWE-24

CVE-2025-68430

Medium · published December 19, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
20.0
In the wild
Unconfirmed
What it is

CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.8.1 through 2.52.0, an attacker with an account on a CVAT instance is able to retrieve the contents of any file system directory accessible to the CVAT server. The exposed information is names of contained files and subdirectories. The contents of files are not accessible. Version 2.53.0 contains a patch. No known workarounds are available.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00286 · 20.0th percentile
Weakness
CWE-24 · Path Traversal: '../filedir'
Published
2025-12-19T23:15Z
Affected products (1)
ProductVersionsFixed in
cvat/computer_vision_annotation_tool≥ 2.8.1, < 2.53.02.53.0
References (2)
https://github.com/cvat-ai/cvat/commit/2c24ef0c3f8fd94f6c71cff4eafcf11bfcaa5f91 · [email protected]https://github.com/cvat-ai/cvat/security/advisories/GHSA-3g7v-xjh7-xmqx · [email protected]
EPSS history
Timeline
  • 19 DEC 17:11Z
    CVAT vulnerable to directory traversal via mounted share listing
    cvelistv5