CVE-2026-47682: CVAT Path Traversal Vulnerability

CVE-2026-47682 Overview

CVE-2026-47682 is a path traversal vulnerability [CWE-22] in Computer Vision Annotation Tool (CVAT), an open source interactive video and image annotation platform. The flaw affects CVAT versions 1.6.0 through 2.64.0. An attacker with write access to an attached cloud storage, or the ability to add a new cloud storage to a CVAT instance, can overwrite arbitrary files on the server's filesystem. The maintainers addressed the issue in version 2.65.0.

Critical Impact
Authenticated attackers can overwrite arbitrary files on the CVAT server, enabling tampering with application code, configuration, or data used by other users of the instance.

Affected Products

CVAT versions 1.6.0 through 2.64.0
Self-hosted CVAT instances with cloud storage integrations enabled
Multi-tenant CVAT deployments where users can register cloud storages

Discovery Timeline

2026-08-04 - CVE-2026-47682 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-47682

Vulnerability Analysis

CVAT integrates with external cloud storage providers so users can pull annotation data and media files directly into the platform. When CVAT processes objects retrieved from a linked cloud storage, it uses attacker-supplied object names to construct local filesystem paths. The application did not sufficiently sanitize these names before joining them with server directories.

An attacker who controls the contents of a connected bucket, or who can add a new cloud storage, can place objects whose names contain traversal sequences such as ../. When CVAT downloads those objects, the resulting write path escapes the intended working directory and lands on arbitrary locations on the server filesystem. This maps to the classic path traversal weakness class [CWE-22].

Root Cause

The root cause is missing validation of untrusted path components derived from cloud storage object keys. The patch in commit 6fda3e3 introduces a helper module, cvat.utils.paths, exposing join_untrusted_path and problem_with_untrusted_path, and routes media filenames through a split_name transformation before they are passed to DataSerializer. This centralizes safe path construction and rejects names that would resolve outside the target directory.

Attack Vector

Exploitation requires authenticated access with permission to either write to an already-attached cloud storage or register a new one. The attacker uploads an object whose key encodes a directory traversal. When any CVAT workflow ingests that object, the server writes attacker-controlled content to the traversed path. Impact is confined to integrity: an attacker can overwrite application files, task manifests, or other data readable by the CVAT service account.

python

# Patch excerpt: cvat/apps/dataset_manager/project.py
data_serializer = DataSerializer(
    data={
-       "server_files": files["media"],
+       "server_files": list(map(split_name, files["media"])),
        # TODO: following fields should be replaced with proper input values from request in future
        "use_cache": False,
        "use_zip_chunks": True,

python

# Patch excerpt: cvat/apps/engine/backup.py
from cvat.utils.paths import join_untrusted_path, problem_with_untrusted_path
from utils.dataset_manifest import ImageManifestManager

Source: cvat-ai/cvat commit 6fda3e3

Detection Methods for CVE-2026-47682

Indicators of Compromise

Cloud storage objects whose keys contain traversal sequences such as ../, ..\\, or URL-encoded variants like %2e%2e%2f.
Unexpected modifications to files under the CVAT installation directory, share/, data/, or Python site-packages used by the CVAT service.
New or recently modified cloud storage registrations preceding filesystem changes on the CVAT host.
Django or worker process log entries showing writes to paths outside the configured task or share directories.

Detection Strategies

Audit CVAT audit logs and database tables for CloudStorage create and update events, correlating with subsequent import or sync jobs.
Enable filesystem integrity monitoring on the CVAT application directory and container image layers to flag unexpected writes.
Inspect object listings in linked buckets for keys that contain .. segments or backslashes and quarantine matches for review.

Monitoring Recommendations

Forward CVAT application logs, container runtime logs, and cloud storage access logs into a centralized analytics platform for correlation.
Alert on writes by the CVAT service account to paths outside its expected working directories.
Track additions of new cloud storage integrations, especially by non-administrator accounts.

How to Mitigate CVE-2026-47682

Immediate Actions Required

Upgrade CVAT to version 2.65.0 or later, which contains the fix in commit 6fda3e3.
Review all existing cloud storage integrations and remove any registered by untrusted users pending upgrade.
Restrict the ability to add cloud storages to trusted administrators via CVAT role and permission settings.
Verify filesystem integrity of the CVAT host and container images before returning the service to normal operation.

Patch Information

The issue is fixed in CVAT 2.65.0. See the GitHub Security Advisory GHSA-6f87-4g86-p9gw and the upstream patch commit for technical details. The fix introduces cvat.utils.paths.join_untrusted_path and applies split_name normalization to media filenames before serialization.

Workarounds

Disable cloud storage functionality in CVAT until the upgrade is applied.
Limit write access on linked buckets to trusted service principals only, blocking user-controlled object key creation.
Run the CVAT service under a low-privilege account with a read-only application directory to reduce blast radius of any arbitrary write.

bash

# Verify the running CVAT version and upgrade the containers
docker exec cvat_server python -c "import cvat; print(cvat.__version__)"

# Pull the fixed release and restart the stack
git fetch --tags
git checkout v2.65.0
docker compose pull
docker compose up -d