Medium severity · published Dec 19, 2025
CVE-2025-68430
CVAT vulnerable to directory traversal via mounted share listing
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.8.1 through 2.52.0, an attacker with an account on a CVAT instance is able to retrieve the contents of any file system directory accessible to the CVAT server. The exposed information is names of contained files and subdirectories. The contents of files are not accessible. Version 2.53.0 contains a patch. No known workarounds are available.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CV
cvat · cvat-ai
>= 2.8.1, < 2.53.0 · source: vendor
CV
Computer Vision Annotation Tool · Cvat
2.8.1 before 2.53.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-68430
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-68430
Patch
https://github.com/cvat-ai/cvat/commit/2c24ef0c3f8fd94f6c71cff4eafcf11bfcaa5f91
Patch
https://github.com/cvat-ai/cvat/security/advisories/GHSA-3g7v-xjh7-xmqx
More from cvat
9.8
CVE-2022-31188
Server-Side Request Forgery Vulnerability in Computer Vision Annotation Tool (CVAT)
8.8
CVE-2026-23526
CVAT vulnerable to privilege escalation of users with staff status
8.5
CVE-2026-73220
CVAT: Stored XSS via annotation guides in audio tasks
8.5
CVE-2026-65986
CVAT has stored XSS via annotation guide assets
8.5
CVE-2026-44369
CVAT: Stored XSS via annotation guides