CVE-2025-25297

Summary

CVE-2025-25297 is a Server-Side Request Forgery (SSRF) vulnerability affecting Label Studio, an open-source data labeling tool, prior to version 1.16.0. The S3 storage integration feature contains this issue, allowing users to specify a custom S3 endpoint URL without proper validation. An attacker can exploit this vulnerability by feeding the application a malicious endpoint, causing it to send HTTP requests to arbitrary internal services. This bypasses network segmentation and potentially enables data exfiltration through error messages containing full response bodies. The vulnerability is patched in version 1.16.0.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.