CVE-2025-49135: CVAT Information Disclosure Vulnerability

CVE-2025-49135 Overview

CVE-2025-49135 affects Computer Vision Annotation Tool (CVAT), an open source platform for interactive video and image annotation. Versions 2.2.0 through 2.39.0 fail to validate ownership of TUS-uploaded files during project or task backup imports. An authenticated attacker holding the user role can reference filenames uploaded by other users and import them as their own projects or tasks. This results in unauthorized access to other tenants' backup data on the same CVAT instance. The flaw is classified as an Insecure Direct Object Reference [CWE-639].

Critical Impact
Authenticated users can access and exfiltrate other users' uploaded backup files by guessing or discovering their filenames.

Affected Products

CVAT versions 2.2.0 through 2.39.0
Self-hosted CVAT deployments with multi-user access
CVAT instances allowing user role account registration

Discovery Timeline

2025-06-25 - CVE-2025-49135 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49135

Vulnerability Analysis

CVAT uses the TUS resumable upload protocol to receive large files before processing them into projects or tasks. When a client requests a backup import, the server accepts a filename via a query parameter and locates the corresponding TUS-uploaded file on disk. The vulnerable code path in cvat/apps/engine/background.py did not verify that the referenced file belonged to the requesting user.

An attacker with a valid user role account can supply the filename of another user's TUS upload. The server then processes that file as if the attacker owned it, importing the contained project or task backup into the attacker's account. Annotation and dataset TUS uploads are not affected because they use object-specific temporary directories that scope files to a resource context.

Root Cause

The root cause is missing authorization on a user-controlled object reference. The backup import handler trusted the filename query parameter without checking the file's owner metadata against request.user. This is a textbook Insecure Direct Object Reference [CWE-639].

Attack Vector

Exploitation requires network access to the CVAT web interface and a low-privileged authenticated account. The attacker must know or guess a target filename produced by the TUS upload process. Once identified, a single HTTP request initiating a backup import with the target filename is sufficient to reassign the file into the attacker's workspace.

python

     TaskFileSerializer,
 )
 from cvat.apps.engine.task import create_thread as create_task
+from cvat.apps.engine.tus import TusFile, TusFileForbiddenError, TusFileNotFoundError
 from cvat.apps.engine.types import ExtendedRequest
 from cvat.apps.engine.utils import (
     build_annotations_file_name,

Source: GitHub Commit dbafd9c. The patch introduces TusFile with explicit TusFileForbiddenError and TusFileNotFoundError exceptions, enforcing ownership checks before the backup import proceeds.

Detection Methods for CVE-2025-49135

Indicators of Compromise

Backup import API requests referencing filenames that do not correspond to the requesting user's prior TUS uploads
Unexpected new projects or tasks appearing in a user account shortly after another user completed an upload
Repeated 4xx responses from the backup import endpoint indicating filename enumeration attempts

Detection Strategies

Correlate TUS upload events with subsequent backup import requests and flag mismatches between the uploader and the importer
Audit CVAT application logs for import operations that reference filenames created by a different user_id
Monitor for user role accounts triggering high volumes of backup import requests across short time windows

Monitoring Recommendations

Forward CVAT web server and application logs into a centralized analytics platform for cross-user correlation
Enable per-request user attribution in reverse proxy access logs fronting CVAT
Alert on creation of projects or tasks that contain data attributable to accounts other than the creator

How to Mitigate CVE-2025-49135

Immediate Actions Required

Upgrade all CVAT deployments to version 2.40.0 or later, which contains the ownership check in cvat/apps/engine/background.py
Review recent backup import activity for cross-user filename references and notify affected users if evidence of unauthorized access is found
Restrict CVAT registration and the user role to trusted accounts until the upgrade is applied

Patch Information

The fix is delivered in CVAT 2.40.0 through commit dbafd9c0287489bea00e1db626f64b107f90bfc9. Details are available in the GitHub Security Advisory GHSA-frpr-5w6q-hh4f and the upstream commit.

Workarounds

No vendor-supplied workarounds are available; upgrading to CVAT 2.40.0 or later is the only supported remediation
Temporarily disable the backup import feature via reverse proxy rules if immediate patching is not possible
Limit the CVAT instance to a single trusted user or tenant until patching completes

bash

# Upgrade CVAT via Docker Compose
git fetch --tags
git checkout v2.40.0
docker compose pull
docker compose up -d
docker compose exec cvat_server python manage.py migrate