Label Studio path traversal vulnerability in image field export
A path traversal vulnerability in Label Studio SDK versions before 1.0.10 allowed unauthorized file access through the image field during export operations. The vulnerability was patched in SDK version 1.0.10 and Label Studio version 1.16.0.
What happened
A path traversal vulnerability in Label Studio SDK versions prior to 1.0.10 allows unauthorized file access outside the intended directory structure. The flaw exists in the VOC, COCO and YOLO export functionalities, which invoke a download function that fails to validate file paths when processing image references during task exports.
By creating tasks with path traversal sequences in the image field, an attacker can force the application to read files from arbitrary server filesystem locations when exporting projects.
Governance controls
Label Studio versions before 1.16.0 specified vulnerable SDK versions prior to 1.0.10 as dependencies. The vulnerability was patched in label-studio-sdk version 1.0.10 and Label Studio version 1.16.0, which replaced unsafe path construction with a safe_build_path function that validates file paths against the base directory.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.