Description
CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.6.0 through 2.64.0, an attacker with write access to a cloud storage that's been added to a CVAT instance, or ability to add new cloud storages, is able to overwrite arbitrary files on the server's filesystem. This issue has been fixed in version 2.65.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| cvat-ai | cvat | >= 1.6.0< 2.65.0 | — |