CVE-2025-49135

CVE-2025-49135 is a medium-severity vulnerability affecting CVAT (Computer Vision Annotation Tool) versions 2.2.0 through 2.39.0. It allows an authenticated attacker with a 'user' role to potentially access and steal other users' data by exploiting a lack of filename validation during the import of project or task backups. The vulnerability has a CVSS score of 6.5, indicating high confidentiality impact with low attack complexity and no user interaction required. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.