CVE-2025-25297 Label Studio allows Server-Side Request Forgery in the S3 Storage Endpoint
Attackers can exploit an SSRF vulnerability in the S3 storage configuration to access internal services and exfiltrate data via error messages.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-25297?
CVE-2025-25297 is a high-severity server-side request forgery vulnerability in HumanSignal label-studio, published on 14 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Label Studio is an open source data labeling tool. Prior to version 1.16.0, Label Studio's S3 storage integration feature contains a Server-Side Request Forgery (SSRF) vulnerability in its endpoint configuration. When creating an S3 storage connection, the application allows users to specify a custom S3 endpoint URL via the s3_endpoint parameter. This endpoint URL is passed directly to the boto3 AWS SDK without proper validation or restrictions on the protocol or destination. The vulnerability allows an attacker to make the application send HTTP requests to arbitrary internal services by specifying them as the S3 endpoint. When the storage sync operation is triggered, the application attempts to make S3 API calls to the specified endpoint, effectively making HTTP requests to the target service and returning the response in error messages. This SSRF vulnerability enables attackers to bypass network segmentation and access internal services that should not be accessible from the external network. The vulnerability is particularly severe because error messages from failed requests contain the full response body, allowing data exfiltration from internal services. Version 1.16.0 contains a patch for the issue.
Weakness: CWE-918
Which versions are affected by CVE-2025-25297?
3 open source packages ship an affected version, including label-studio. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
label-studio PyPI | All versions | 1.16.0 |
label-studio PyPI | All versions | 1.16.0 |
label-studio PyPI | All versions | 1.16.0 |
Products include Humansignal Label Studio.
How do I fix CVE-2025-25297?
Upgrade label-studio to 1.16.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-25297 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-25297 exists.
Other vulnerabilities in HumanSignal label-studio
- CVE-2023-43791 Label Studio has Hardcoded Django `SECRET_KEY` that can be Abused to Forge Session Tokens
- CVE-2026-22033 Label Studio vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field
- CVE-2025-47783 label-studio vulnerable to Cross-Site Scripting (Reflected) via the label_config parameter.
- CVE-2023-47117 Object Relational Mapper Leak Vulnerability in Filtering Task in Label Studio
- CVE-2023-47115 Label Studio XSS Vulnerability on Avatar Upload
Sources
Also known as GHSA-m238-fmcw-wh58, PYSEC-2026-1503.