CVE-2026-47682
Received Received - Intake

Arbitrary File Overwrite in CVAT via Cloud Storage

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: GitHub, Inc.

Description
CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.6.0 through 2.64.0, an attacker with write access to a cloud storage that's been added to a CVAT instance, or ability to add new cloud storages, is able to overwrite arbitrary files on the server's filesystem. This issue has been fixed in version 2.65.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-05
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-47682
EUVD
EUVD-2026-52892

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
cvat-ai cvat From 1.6.0 (inc) to 2.64.0 (inc)
cvat-ai cvat 2.65.0
opencv cvat From 1.6.0 (inc) to 2.64.0 (inc)
opencv cvat 2.65.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-47682 is a path traversal vulnerability in CVAT (Computer Vision Annotation Tool) versions 1.6.0 through 2.64.0. It allows attackers with write access to cloud storage or the ability to add new cloud storages to overwrite arbitrary files on the server's filesystem by manipulating file paths.

Detection Guidance

Check CVAT version with: pip show cvat-sdk or docker inspect cvat/cvat-server. If version is between 1.6.0 and 2.64.0, the system is vulnerable. Review cloud storage configurations for unauthorized path modifications or suspicious file writes in server directories.

Impact Analysis

This vulnerability can allow attackers to overwrite critical files on the server, potentially leading to system compromise, data corruption, or unauthorized modifications. It requires low privileges and no user interaction, making it exploitable remotely.

Compliance Impact

This vulnerability allows attackers to overwrite arbitrary files on the server's filesystem, which could lead to unauthorized modifications of sensitive data or system configurations. Such file overwrites may compromise data integrity and confidentiality, potentially violating compliance requirements under standards like GDPR (data integrity and confidentiality) and HIPAA (integrity of protected health information).

Mitigation Strategies

Upgrade CVAT to version 2.65.0 or later immediately. Remove write access to cloud storages from untrusted users. Audit file system permissions and restrict access to CVAT server directories. Monitor for unexpected file modifications or unauthorized cloud storage additions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47682. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart