CVE-2026-47682CWE-22path-traversal

CVE-2026-47682

published August 5, 2026

CVSS
7.1
EPSS
0%
Percentile
38.4
In the wild
Unconfirmed
What it is

CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.6.0 through 2.64.0, an attacker with write access to a cloud storage that's been added to a CVAT instance, or ability to add new cloud storages, is able to overwrite arbitrary files on the server's filesystem. This issue has been fixed in version 2.65.0.

The record
Technical detail
CVSS
7.1 · NONE
CVSS v4.0
Not supplied
EPSS
0.00454 · 38.4th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-08-05T00:16Z
References (2)
https://github.com/cvat-ai/cvat/commit/6fda3e3285a185ae50039d1af8c8f0e9319b671c · [email protected]https://github.com/cvat-ai/cvat/security/advisories/GHSA-6f87-4g86-p9gw · [email protected]
EPSS history
Timeline
  • 04 AUG 20:00Z
    CVAT: Missing path-containment validation in multiple entry points allows arbitrary path writes
    cvelistv5