Information Disclosure Vulnerability in Frigate Network Video Recorder by Blake Blackshear

CVE-2025-62382

What is CVE-2025-62382?

Frigate, a network video recorder with real-time local object detection capabilities, has a vulnerability that allows authenticated operators to exploit its export workflow. Specifically, prior to version 0.16.2, an operator could designate any filesystem location as the source for video thumbnails, breaching the security of the system. This flaw permits low-privilege users with API access to potentially exfiltrate sensitive files, such as configuration files and secrets, from the host. The exploit relies on a narrow timing window where the file is copied to a publicly accessible directory before the cleanup process. This flaw can lead to unauthorized access to sensitive data, compromising the overall security of the Frigate system.

References