Vulnerability · Published Dec 19, 2025 · Assigned by GitHub_M

CVE-2025-68430CVAT vulnerable to directory traversal via mounted share listing

Medium 5.3

In plain English

A medium-severity security flaw in cvat from cvat-ai. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 4.0)5.3Medium

Exploit odds (30 days)0.3%top 78.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.8.1 through 2.52.0, an attacker with an account on a CVAT instance is able to retrieve the contents of any file system directory accessible to the CVAT server. The exposed information is names of contained files and subdirectories. The contents of files are not accessible. Version 2.53.0 contains a patch. No known workarounds are available.

Affected products (as reported)

Vendor	Product	Versions
cvat-ai	cvat	>= 2.8.1, < 2.53.0

Weakness: CWE-24 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/cvat-ai/cvat/security/advisories/GHSA-3g7v-xjh7-xmqx x_refsource_CONFIRM
https://github.com/cvat-ai/cvat/commit/2c24ef0c3f8fd94f6c71cff4eafcf11bfcaa5f91 x_refsource_MISC