CVE-2026-47682: CVAT: Missing path-containment validation in multiple entry points allows arbitrary path writes
CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.6.0 through 2.64.0, an attacker with write access to a cloud storage that's been added to a CVAT instance, or ability to add new cloud storages, is able to overwrite arbitrary files on the server's filesystem. This issue has been fixed in version 2.65.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CVATto a version that resolves this vulnerability.Fixed in 2.65.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47682?
The severity of CVE-2026-47682 is rated high with a CVSS score of 7.1.
How do I fix CVE-2026-47682?
To fix CVE-2026-47682, ensure that path-containment validation is implemented for all entry points where cloud storage paths are accessed.
What type of vulnerability is CVE-2026-47682?
CVE-2026-47682 is classified as a Path Traversal vulnerability.
What can an attacker do with CVE-2026-47682?
An attacker with write access to cloud storage added to a CVAT instance can overwrite arbitrary files on the server.
Which versions of CVAT are affected by CVE-2026-47682?
CVE-2026-47682 affects CVAT versions 1.6.0 through 2.64.0.