CVE-2025-25297: SSRF in Label Studio ≤1.9.2.post0

The SSRF vulnerability in Label Studio allows an attacker to bypass security controls and potentially access sensitive internal resources. By specifying a malicious S3 endpoint URL, an attacker can trick Label Studio into making requests to internal services that are not directly exposed to the internet. This could lead to data exfiltration, privilege escalation, or even remote code execution if the targeted internal service is vulnerable. The blast radius extends to any internal service accessible via HTTP, potentially compromising the entire internal network. This vulnerability shares similarities with other SSRF exploits where attackers leverage trusted applications to probe and access internal infrastructure.

1. Reserved2025-02-06
2. Published2025-02-14
3. EPSS updated2026-04-02

The primary mitigation for CVE-2025-25297 is to upgrade Label Studio to version 1.16.0 or later, which includes the necessary fixes. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict network access to the Label Studio server to only allow connections to authorized S3 endpoints. Implement strict input validation on the s3_endpoint parameter to prevent attackers from injecting malicious URLs. Consider using a Web Application Firewall (WAF) to filter out requests with suspicious S3 endpoint URLs. After upgrading, confirm the fix by attempting to create an S3 connection with a known malicious endpoint URL; the connection should fail with an appropriate error message.