Directory Exposure Vulnerability in CVAT Tool by CVAT.ai
CVE-2025-68430

5.3MEDIUM

Key Information:

Vendor

Cvat-ai

Status
Cvat
Vendor
CVE Published:
19 December 2025

What is CVE-2025-68430?

CVAT, an open source interactive video and image annotation tool, is affected by a directory exposure vulnerability in versions from 2.8.1 to 2.52.0. This flaw allows authenticated users to access the names of files and subdirectories within any directory that is accessible to the CVAT server. While the contents of these files remain secured, the exposure of file and subdirectory names sparks privacy concerns and potential information leakage. Users are advised to upgrade to version 2.53.0 or later, which addresses this issue; unfortunately, no workarounds are currently available.

Affected Version(s)

cvat >= 2.8.1, < 2.53.0

References

https://github.com/cvat-ai/cvat/security/advisories/GHSA-...
x_refsource_CONFIRM
https://github.com/cvat-ai/cvat/commit/2c24ef0c3f8fd94f6c...
x_refsource_MISC

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-68430 : Directory Exposure Vulnerability in CVAT Tool by CVAT.ai