CVE-2026-47682

7.1 Élevée

Publiée le 04/08/2026 à 22:16 · Modifiée le 10/09/2026 à 22:36 · En attente d'analyse NVD · Source : security-advisories@github.com

Description

CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.6.0 through 2.64.0, an attacker with write access to a cloud storage that's been added to a CVAT instance, or ability to add new cloud storages, is able to overwrite arbitrary files on the server's filesystem. This issue has been fixed in version 2.65.0.

Traduire en français

Produits concernés

cvat-ai cvat

Scores CVSS

Version	Score	Source	Vecteur
4.0	7.1 Élevée	security-advisories@github.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`

Faiblesses (CWE)

CWE-22

Références

https://github.com/cvat-ai/cvat/commit/6fda3e3285a185ae50039d1af8c8f0e9319b671c
https://github.com/cvat-ai/cvat/security/advisories/GHSA-6f87-4g86-p9gw

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories