CVAT File Overwrite Vulnerability for Users with Global Role

A vulnerability in CVAT (Computer Vision Annotation Tool) versions 2.4.0 through 2.48.1 allows malicious users with at least the User global role to create or overwrite files in the root of a mounted file share. If no file share is mounted, the user can write files to the share directory of the import worker container, potentially consuming available disk space.

Impact

Exploitation of this vulnerability could lead to unauthorized file creation or modification, with potential disruption of disk space availability.

Remediation

Users are advised to update CVAT to version 2.49.0 or later.