CVE-2026-47682
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
CVAT versions 1.6.0 through 2.64.0 contain a vulnerability that allows an attacker with write access to a cloud storage added to a CVAT instance, or ability to add new cloud storages, to overwrite arbitrary files on the server's filesystem. This issue has been fixed in version 2.65.0.
Risk Assessment
An attacker can overwrite arbitrary files on the server, potentially leading to system integrity compromise and, in extreme cases, remote code execution.
Recommendation
Update CVAT to version 2.65.0 or later. Restrict cloud storage permissions and monitor activity.
Other vulnerabilities in CVAT
See all- CVE-2026-73220High
CVAT, an open source annotation tool, versions 2.68.0 to 2.70.0 contain an XSS vulnerability in the audio annotation guide renderer. A user with guide creation/edit privileges can store malicious JavaScript that executes when another user opens the guide, allowing arbitrary CVAT requests with victim privileges. Fixed in version 2.70.0.
- CVE-2026-73221Medium
CVAT from version 2.17.0 until 2.72.0 has a vulnerability that allows a user with the Worker role to use predictable task-based request IDs with the lambda request retrieve and destroy endpoints to view automatic annotation requests for tasks or jobs the user cannot access and cancel requests initiated by other users. This issue is fixed in version 2.72.0.
- CVE-2026-73219Medium
CVAT is an open source interactive video and image annotation tool. From 2.17.0 until 2.72.0, a user with write access to a CVAT job can submit a batch automatic annotation request with inconsistent task and job IDs, blocking automatic annotation for another task whose ID is known. This issue is fixed in version 2.72.0.
- CVE-2026-65986High
In CVAT versions 2.5.0 through 2.66.0, there is an XSS vulnerability accessible through annotation guide assets. When CVAT serves files attached to an annotation guide, it labels them with a media type that the attacker can influence, allowing the victim's browser to treat the file as an HTML page and run any JavaScript inside it. This issue has been fixed in version 2.67.0.
- CVE-2026-58373Medium
A vulnerability in CVAT before version 2.69.0 in the QualityReportViewSet.get_queryset allows authenticated attackers to enumerate quality report identifiers belonging to other organizations. The missing check_object_permissions call on the parent_id parameter in the quality reports API endpoint enables distinguishing existing and non-existing reports via HTTP 500 vs 404 responses.
Original NVD description (English source)
CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.6.0 through 2.64.0, an attacker with write access to a cloud storage that's been added to a CVAT instance, or ability to add new cloud storages, is able to overwrite arbitrary files on the server's filesystem. This issue has been fixed in version 2.65.0.