CVE-2025-25295

Label Studio SDK <1.0.10 path traversal allows arbitrary file read via crafted image paths.

• CVSS 8.7
• CWE-22
• Input Validation and Sanitization
• Remote

Label Studio is an open source data labeling tool. A path traversal vulnerability in Label Studio SDK versions prior to 1.0.10 allows unauthorized file access outside the intended directory structure. The flaw exists in the VOC, COCO and YOLO export functionalities. These functions invoke a `download` function on the `label-studio-sdk` python package, which fails to validate file paths when processing image references during task exports. By creating tasks with path traversal sequences in the image field, an attacker can force the application to read files from arbitrary server filesystem locations when exporting projects in any of the mentioned formats. This is authentication-required vulnerability allowing arbitrary file reads from the server filesystem. It may lead to potential exposure of sensitive information like configuration files, credentials, and confidential data. Label Studio versions before 1.16.0 specified SDK versions prior to 1.0.10 as dependencies, and the issue was confirmed in Label Studio version 1.13.2.dev0; therefore, Label Studio users should upgrade to 1.16.0 or newer to mitigate it.

CVE

CVE-2025-25295

CWE

CWE-22

CVSS base score

8.7

Published

2025-02-14

OWASP

A01 Broken Access Control

Orthogonal defect classification

Interface

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Path Traversal

Accessibility scope

Remote

Impact

Information Disclosure

Affected component

label-studio

Fixed by upgrading

Yes

Solution

Upgrade to Label Studio version 1.16.0 or newer.

import os
from label_studio_sdk import Client 

def download(url, output_dir, filename=None, session=None, **kwargs):
    filepath = url
    output_path = os.path.join(output_dir, os.path.basename(filepath))

    try:
        print(f"Simulating reading file: {filepath}")

        with open(filepath, 'r') as f:
          contents = f.read()
          print(f"File contents (simulated): {contents[:50]}...")

        print(f"Simulating saving to: {output_path}")

    except FileNotFoundError:
        print(f"File not found: {filepath}")
    except Exception as e:
        print(f"Error processing file: {e}")

import os

def download(file_path, base_dir="/path/to/directory"):
    
    abs_path = os.path.abspath(file_path) 
    abs_base_dir = os.path.abspath(base_dir)

    normalized_path = os.path.normpath(abs_path)
    normalized_base_dir = os.path.normpath(abs_base_dir)
    
    if not normalized_path.startswith(normalized_base_dir):
        print(f"Attempted access outside of base directory: {file_path}")
        return None

    try:
        with open(normalized_path, "rb") as f:
            return f.read()
    except FileNotFoundError:
        print(f"File not found: {file_path}")
        return None
    except Exception as e:
        print(f"Error reading file: {file_path} - {e}")
        return None

`../../../etc/passwd`

@misc{vaitp:cve202525295,
  title        = {{Label Studio SDK <1.0.10 path traversal allows arbitrary file read via crafted image paths.
}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2025},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2025-25295},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2025-25295/}}
}