CVE-2025-49135

creationtimestamp| type| source ---|---|--- 2025-06-25 15:52:17+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/19471 2025-06-25 16:46:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lsh2sek2me2s...

CVE-2025-49135 CVAT missing validation for in-progress backup upload names

CVAT is an open source interactive video and image annotation tool for computer vision. Versions 2.2.0 through 2.39.0 have no validation during the import process of a project or task backup to check that the filename specified in the query parameter refers to a TUS-uploaded file belonging to the...