CVAT versions 2.5.0 through 2.66.9 are vulnerable to cross-site scripting and arbitrary file uploads, allowing authenticated attackers to compromise the application.

The application is susceptible to Cross-site Scripting (CWE-79) and Unrestricted Upload of File with Dangerous Type (CWE-434), both of which can be triggered by an authenticated user.

The combination of these vulnerabilities allows for the execution of malicious scripts and the potential for remote code execution via dangerous file uploads. Given the CVSS score of 8.5, this poses a significant risk of account takeover and data exfiltration, directly impacting the integrity of the annotation workflow and the data housed within the platform.

Immediate Action: Upgrade to CVAT version 2.67.0 or later as advised by the vendor security advisory to patch both the XSS and file upload vulnerabilities.

Proactive Monitoring: Inspect application logs for anomalous file upload events and monitor user sessions for signs of script injection or unauthorized redirects.

Compensating Controls: Implement strict file type validation at the network or application layer and utilize a Content Security Policy (CSP) to mitigate the impact of cross-site scripting attempts.

Public Exploit Available: Unknown.

Administrators should treat this as a high-risk finding. It is imperative to update the CVAT installation to the latest version immediately to prevent authenticated users from escalating their impact and compromising the underlying system infrastructure.