CVE-2025-25295: Label Studio Path Traversal Vulnerability

CVE-2025-25295 Overview

Label Studio is an open source data labeling platform widely used in machine learning workflows. CVE-2025-25295 is a path traversal vulnerability [CWE-22] in the label-studio-sdk Python package versions prior to 1.0.10. The flaw resides in the VOC, COCO, and YOLO export functions, which invoke a download routine that fails to validate file paths when processing image references during task exports. An authenticated attacker can craft tasks containing path traversal sequences in the image field. When a project is exported, the application reads arbitrary files from the server filesystem.

Critical Impact
An authenticated attacker can read arbitrary files from the Label Studio server filesystem, exposing configuration files, credentials, and other confidential data.

Affected Products

label-studio-sdk versions prior to 1.0.10
Label Studio versions prior to 1.16.0 (which pin vulnerable SDK versions)
Label Studio version 1.13.2.dev0 (confirmed vulnerable)

Discovery Timeline

2025-02-14 - CVE-2025-25295 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-25295

Vulnerability Analysis

The vulnerability stems from insufficient path validation in the label-studio-sdk export pipeline. When users export annotation projects in VOC, COCO, or YOLO formats, the SDK invokes an internal download function to retrieve image files referenced by each task. The function treats the image field of a task as a trusted file reference and resolves it directly against the server filesystem. Because the path is not normalized or constrained to the project's media directory, traversal sequences such as ../ escape the intended directory. The exported archive then contains contents of arbitrary files accessible to the Label Studio process.

Root Cause

The root cause is missing canonicalization and allowlist enforcement on file paths supplied through task data. The download helper accepts user-controlled image paths without verifying they resolve within the configured media root. This is a classic CWE-22 Path Traversal weakness where untrusted input flows into a filesystem read operation.

Attack Vector

Exploitation requires authentication but no elevated privileges. An attacker with permission to create or modify tasks in a project inserts a malicious value into the image field, for example ../../../../etc/passwd or a path to a configuration file containing credentials. The attacker then triggers an export in VOC, COCO, or YOLO format. The resulting export bundle contains the targeted file. Because the attack vector is network-based and complexity is low, any authenticated user who can reach the export functionality can retrieve sensitive server-side files.

No verified exploitation code is published. Refer to the GitHub Security Advisory GHSA-rgv9-w7jp-m23g for technical details.

Detection Methods for CVE-2025-25295

Indicators of Compromise

Task records containing ../ or absolute filesystem paths such as /etc/, /root/, or /var/ in the image field.
Export job logs referencing files outside the configured media or upload directory.
Unusually large export archives or archives containing files with non-image extensions such as .conf, .env, .key, or .yaml.
Repeated export requests from a single authenticated user account targeting multiple projects.

Detection Strategies

Inspect Label Studio task databases for image field values containing traversal sequences or absolute paths.
Audit application logs for export operations in VOC, COCO, or YOLO formats and correlate with the requesting user.
Monitor filesystem access by the Label Studio service process for reads outside the media directory.

Monitoring Recommendations

Enable verbose logging on the label-studio-sdk export endpoints and forward logs to a centralized analytics platform.
Alert on file reads by the Label Studio process targeting sensitive paths such as /etc/passwd, /etc/shadow, or application configuration directories.
Track export volume per user and flag anomalous spikes that may indicate bulk file harvesting.

How to Mitigate CVE-2025-25295

Immediate Actions Required

Upgrade Label Studio to version 1.16.0 or later, which pins label-studio-sdk 1.0.10 or newer.
Upgrade standalone label-studio-sdk installations to version 1.0.10 or later.
Rotate any credentials, API keys, or secrets stored on the Label Studio server that may have been exposed.
Audit existing tasks for malicious image field values and remove tainted entries.

Patch Information

The fix is published in label-studio-sdk version 1.0.10 and adopted by Label Studio 1.16.0. The code change validates file paths during export operations. See the GitHub commit 4a9715c for the upstream patch.

Workarounds

Restrict project creation and task import permissions to trusted users only until patches are applied.
Run the Label Studio service under a dedicated low-privilege account with filesystem access limited to the media directory.
Apply mandatory access controls such as AppArmor or SELinux profiles that confine Label Studio to its data directories.
Place the application behind a reverse proxy that logs and inspects export endpoint usage.

bash

# Upgrade Label Studio and the SDK to patched versions
pip install --upgrade 'label-studio>=1.16.0'
pip install --upgrade 'label-studio-sdk>=1.0.10'

# Verify installed versions
pip show label-studio | grep -i version
pip show label-studio-sdk | grep -i version