Medium severity · published Nov 7, 2025
CVE-2025-64485
CVAT: Mounted share file overwrite via crafted request
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.4.0 through 2.48.1, a malicious CVAT user with at least the User global role may create files in the root of the mounted file share, or overwrite existing files. If no file share is mounted, the user will be able to create files in the share directory of the import worker container, potentially filling up disk space. This issue is fixed in version 2.49.0.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CV
cvat · cvat-ai
<= 2.4.0, < 2.49.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-64485
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-64485
github.com
https://github.com/cvat-ai/cvat/commit/cace877189528a7ed4a224476f4bc0bd5a21d40c
github.com
https://github.com/cvat-ai/cvat/security/advisories/GHSA-x396-w86c-gf6w
More from cvat
9.8
CVE-2025-23045
CVAT allows remote code execution via tracker Nuclio functions
9.8
CVE-2022-31188
Server-Side Request Forgery Vulnerability in Computer Vision Annotation Tool (CVAT)
8.8
CVE-2026-23526
CVAT vulnerable to privilege escalation of users with staff status
8.5
CVE-2026-73220
CVAT: Stored XSS via annotation guides in audio tasks
8.5
CVE-2026-65986
CVAT has stored XSS via annotation guide assets