Back to Database
Status published
High
CVE-2022-31188
Server-Side Request Forgery Vulnerability in Computer Vision Annotation Tool (CVAT)
Vulnerability Description
CVAT is an opensource interactive video and image annotation tool for computer vision. Versions prior to 2.0.0 were found to be subject to a Server-side request forgery (SSRF) vulnerability. Validation has been added to urls used in the affected code path in version 2.0.0. Users are advised to upgrade. There are no known workarounds for this issue.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-31188
Credits & Attribution
No credits recorded in the NVD database.
References
More from cvat-ai
View All →CVE-2025-68430
CVAT vulnerable to directory traversal via mounted share listing
Medium
5.3
CVE-2025-64485
CVAT: Mounted share file overwrite via crafted request
Medium
5.3
CVE-2025-54573
CVAT vulnerable to email verification bypass by use of basic authentication
Medium
4.3
CVE-2025-49135
CVAT missing validation for in-progress backup upload names
Medium
5.3
CVE-2025-48381
CVAT has information disclosure via browsable API
Medium
5.3
Affected Vendor
cvat-ai
View all reports →Affected Software
cvat
Vulnerable Versions:
< 2.0.0
Timeline
Official Publish:
August 1st, 2022
Last Modified:
April 22nd, 2025
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L