Path Traversal in Cvat-Ai Cvat
CVE-2026-47682
CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.6.0 through 2.64.0, an attacker with write access to a cloud storage that's been added to a CVAT instance, or ability to add new cloud storages, is able to overwrite arbitrary files on the server's filesystem. This issue has been fixed in version 2.65.0.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.003 (23.3th percentile) — read the EPSS interpretation.
Affected products
- Cvat-ai Cvat — versions >= 1.6.0< 2.65.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_CONFIRM)