berrydb (>=1.0.9, <=1.1.2) potentially affected by CVE-2025-25295 via label-studio-sdk (0.0.1)

label-studio-sdk PYPI version 0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio-sdk and may be impacted: - berrydb =1.0.9, =1.1.2 Source cves: CVE-2025-25295 Source advisory: OSV:PYSEC-2026-1506...

gantry (>=0.5.11, <=0.6.13) potentially affected by CVE-2025-25295 via label-studio-sdk (0.0.21)

label-studio-sdk PYPI version 0.0.21 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio-sdk and may be impacted: - gantry =0.5.11, =0.6.13 Source cves: CVE-2025-25295 Source advisory: OSV:PYSEC-2026-1506...

datapipe-label-studio-lite (>=0.2.0, <=0.3.3) potentially affected by CVE-2025-25295 via label-studio-sdk (0.0.16)

label-studio-sdk PYPI version 0.0.16 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio-sdk and may be impacted: - datapipe-label-studio-lite =0.2.0, =0.3.3 Source cves: CVE-2025-25295 Source advisory: OSV:PYSEC-2026-1506...

nerblackbox (>=0.0.15, <=1.0.0) potentially affected by CVE-2025-25295 via label-studio-sdk (0.0.34)

label-studio-sdk PYPI version 0.0.34 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio-sdk and may be impacted: - nerblackbox =0.0.15, =1.0.0 Source cves: CVE-2025-25295 Source advisory: OSV:PYSEC-2026-1506...

berrydb (>=1.1.3, <=1.5.1), label-studio (>=1.13.0, <=1.15.0) potentially affected by CVE-2025-25295 via label-studio-sdk (>=1.0.4, <=1.0.8)

label-studio-sdk PYPI version =1.0.4, =1.1.3, =1.13.0, =1.15.0 Source cves: CVE-2025-25295 Source advisory: OSV:PYSEC-2026-1506...

CVE-2025-25295

Label Studio is an open source data labeling tool. A path traversal vulnerability in Label Studio SDK versions prior to 1.0.10 allows unauthorized file access outside the intended directory structure. The flaw exists in the VOC, COCO and YOLO export functionalities. These functions invoke a...

berrydb (>=1.1.3, <=1.5.1), label-studio (>=1.13.0, <=1.15.0) potentially affected by CVE-2025-25295 via label-studio-sdk (>=1.0.4, <=1.0.8)

label-studio-sdk PYPI version =1.0.4, =1.1.3, =1.13.0, =1.15.0 Source cves: CVE-2025-25295 Source advisory: SNYK:PYTHON-LABELSTUDIOSDK-8730849...

CVE-2025-25295

Label Studio is an open source data labeling tool. A path traversal vulnerability in Label Studio SDK versions prior to 1.0.10 allows unauthorized file access outside the intended directory structure. The flaw exists in the VOC, COCO and YOLO export functionalities. These functions invoke a...

CVE-2025-25295

Summary: CVE-2025-25295 affects Label Studio and its SDK with a path traversal vulnerability in VOC/COCO/YOLO exports. The root cause is improper file path validation in the label-studio-sdk download function, which processes image references during task exports and can read arbitrary server file...

CVE-2025-25295

Label Studio is an open source data labeling tool. A path traversal vulnerability in Label Studio SDK versions prior to 1.0.10 allows unauthorized file access outside the intended directory structure. The flaw exists in the VOC, COCO and YOLO export functionalities. These functions invoke a...

berrydb (>=1.0.9, <=1.5.1), datapipe-label-studio-lite (>=0.2.0, <=0.3.3) +3 more potentially affected by CVE-2025-25295 via label-studio-sdk (>=0.0.1, <=1.0.8)

label-studio-sdk PYPI version =0.0.1, =1.0.9, =0.2.0, =0.5.11, =1.13.0, =0.0.15, =1.0.0 Source cves: CVE-2025-25295 Source advisory: MEND:CVE-2025-25295...

datapipe-label-studio-lite (>=0.2.0, <=0.3.3) potentially affected by CVE-2025-25295 via label-studio-sdk (0.0.16)

label-studio-sdk PYPI version 0.0.16 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio-sdk and may be impacted: - datapipe-label-studio-lite =0.2.0, =0.3.3 Source cves: CVE-2025-25295 Source advisory: OSV:GHSA-RGV9-W7JP-M23G...

gantry (>=0.5.11, <=0.6.13) potentially affected by CVE-2025-25295 via label-studio-sdk (0.0.21)

label-studio-sdk PYPI version 0.0.21 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio-sdk and may be impacted: - gantry =0.5.11, =0.6.13 Source cves: CVE-2025-25295 Source advisory: OSV:GHSA-RGV9-W7JP-M23G...

nerblackbox (>=0.0.15, <=1.0.0) potentially affected by CVE-2025-25295 via label-studio-sdk (0.0.34)

label-studio-sdk PYPI version 0.0.34 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio-sdk and may be impacted: - nerblackbox =0.0.15, =1.0.0 Source cves: CVE-2025-25295 Source advisory: OSV:GHSA-RGV9-W7JP-M23G...

berrydb (>=1.1.3, <=1.5.1), label-studio (>=1.13.0, <=1.15.0) potentially affected by CVE-2025-25295 via label-studio-sdk (>=1.0.4, <=1.0.8)

label-studio-sdk PYPI version =1.0.4, =1.1.3, =1.13.0, =1.15.0 Source cves: CVE-2025-25295 Source advisory: GHSA-RGV9-W7JP-M23G...

berrydb (>=1.1.3, <=1.5.1), label-studio (>=1.13.0, <=1.15.0) potentially affected by CVE-2025-25295 via label-studio-sdk (>=1.0.4, <=1.0.8)

label-studio-sdk PYPI version =1.0.4, =1.1.3, =1.13.0, =1.15.0 Source cves: CVE-2025-25295 Source advisory: OSV:GHSA-RGV9-W7JP-M23G...

berrydb (>=1.0.9, <=1.1.2) potentially affected by CVE-2025-25295 via label-studio-sdk (0.0.1)

label-studio-sdk PYPI version 0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio-sdk and may be impacted: - berrydb =1.0.9, =1.1.2 Source cves: CVE-2025-25295 Source advisory: OSV:GHSA-RGV9-W7JP-M23G...

CVE-2025-25295: Improper Limitation of a Pathname to a Restricted Directory

Label Studio is an open source data labeling tool. A path traversal vulnerability in Label Studio SDK versions prior to 1.0.10 allows unauthorized file access outside the intended directory structure. The flaw exists in the VOC, COCO and YOLO export functionalities. These functions invoke a...