CVE-2026-47682 in CVAT
Summary
by MITRE • 08/04/2026
CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.6.0 through 2.64.0, an attacker with write access to a cloud storage that's been added to a CVAT instance, or ability to add new cloud storages, is able to overwrite arbitrary files on the server's filesystem. This issue has been fixed in version 2.65.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/04/2026
The vulnerability identified in CVAT versions 1.6.0 through 2.64.0 represents a critical path traversal and file overwrite flaw that fundamentally undermines the security boundaries of the annotation platform. This issue arises from insufficient validation of cloud storage paths and file operations within the application's storage handling mechanisms, creating a privilege escalation vector where attackers with write access to cloud storage can manipulate server-side filesystem contents. The vulnerability specifically affects systems where CVAT instances have been configured to utilize external cloud storage solutions, making it particularly dangerous in multi-tenant environments where multiple users or projects share the same infrastructure.
The technical implementation of this flaw stems from inadequate input sanitization and path resolution logic within CVAT's cloud storage integration modules. When an attacker with write privileges to a connected cloud storage resource can manipulate file paths through crafted requests or storage configurations, they can potentially navigate beyond their intended storage boundaries and overwrite critical system files on the server hosting the CVAT instance. This vulnerability operates at the intersection of improper input validation and insecure direct object references, creating conditions where arbitrary file operations can be executed with elevated privileges. The flaw aligns with CWE-22 Path Traversal and CWE-73 External Control of File Name or Path categories, representing a classic case of insufficient path validation that allows attackers to bypass normal access controls.
The operational impact of this vulnerability extends far beyond simple data corruption, as it can enable complete system compromise and persistence within the affected environment. An attacker who successfully exploits this vulnerability could overwrite critical application files, configuration settings, or even system binaries, potentially leading to full system takeover or denial of service conditions. The severity is amplified in cloud environments where CVAT instances may be running with elevated privileges or where the underlying infrastructure shares resources with other sensitive applications. This vulnerability essentially transforms a legitimate storage integration feature into a potential attack vector for lateral movement and privilege escalation within the broader system architecture.
Mitigation strategies should focus on immediate version upgrades to 2.65.0 or later, which contain the necessary patches addressing the path traversal and file overwrite conditions. Organizations should also implement strict access controls for cloud storage integrations, ensuring that only trusted entities have write privileges to storage resources connected to CVAT instances. Network segmentation and monitoring of storage access patterns can help detect anomalous behavior indicative of exploitation attempts. Additionally, implementing principle of least privilege configurations where CVAT instances operate with minimal required permissions and regular security audits of storage integration points will significantly reduce the attack surface. This vulnerability demonstrates the importance of validating all external inputs through cloud storage integrations and aligns with ATT&CK technique T1078 Valid Accounts and T1566 Phishing to gain initial access, emphasizing the need for comprehensive security controls around third-party storage connections.