CVE-2025-68430Medium· 4.3▾ SunlitCVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.8.1 through 2.52.0, an attacker with an account on a CVAT instance is able to retrieve the contents of any file system directory access…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.8.1 through 2.52.0, an attacker with an account on a CVAT instance is able to retrieve the contents of any file system directory accessible to the CVAT server. The exposed information is names of contained files and subdirectories. The contents of files are not accessible. Version 2.53.0 contains a patch. No known workarounds are available.
computer_vision_annotation_tool >= 2.8.1, < 2.53.0Upgrade past the affected range:
computer_vision_annotation_tool 2.53.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-58373Medium· 4.3CVAT before 2.69.0 contains an improper authorization vulnerability in QualityReportViewSet.get_queryset that allows authenticated attackers to enumerate quality report identifiers belonging to other organizations by exploiting a missing…
CVE-2026-41082High· 7.3In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.
CVE-2025-61318Critical· 9.1Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability
CVE-2026-108980High· 8.8Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin
CVE-2025-60344High· 8.6A path traversal (directory traversal) vulnerability in D-Link DSR series routers allows unauthenticated remote attackers to manipulate input parameters used for file or directory path resolution (e.g., via sequences such as “../”)
CVE-2025-13199Medium· 5.3A vulnerability was found in code-projects Email Logging Interface 2.0