# CVE-2025-25297: Label Studio allows Server-Side Request Forgery in the S3 Storage Endpoint > Attackers can exploit an SSRF vulnerability in the S3 storage configuration to access internal services and exfiltrate data via error messages. - **Severity:** High 8.6 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N`) - **Exploited in the wild:** Not known - **Login needed:** Not needed - **Attackable:** Over the internet - **Victim action needed:** Not needed - **Fix available:** Yes - **Published:** 14 Feb 2025 - **Updated:** 14 Feb 2025 - **Also known as:** GHSA-m238-fmcw-wh58, PYSEC-2026-1503 ## What is CVE-2025-25297? CVE-2025-25297 is a high-severity server-side request forgery vulnerability in HumanSignal label-studio, published on 14 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim. ### Official description Label Studio is an open source data labeling tool. Prior to version 1.16.0, Label Studio's S3 storage integration feature contains a Server-Side Request Forgery (SSRF) vulnerability in its endpoint configuration. When creating an S3 storage connection, the application allows users to specify a custom S3 endpoint URL via the s3_endpoint parameter. This endpoint URL is passed directly to the boto3 AWS SDK without proper validation or restrictions on the protocol or destination. The vulnerability allows an attacker to make the application send HTTP requests to arbitrary internal services by specifying them as the S3 endpoint. When the storage sync operation is triggered, the application attempts to make S3 API calls to the specified endpoint, effectively making HTTP requests to the target service and returning the response in error messages. This SSRF vulnerability enables attackers to bypass network segmentation and access internal services that should not be accessible from the external network. The vulnerability is particularly severe because error messages from failed requests contain the full response body, allowing data exfiltration from internal services. Version 1.16.0 contains a patch for the issue. Weakness: CWE-918 (Server-Side Request Forgery) ## Which versions are affected by CVE-2025-25297? 3 open source packages ship an affected version, including label-studio. It affects 1 product. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `label-studio` | PyPI | All versions | 1.16.0 | | `label-studio` | PyPI | All versions | 1.16.0 | | `label-studio` | PyPI | All versions | 1.16.0 | Products: Humansignal Label Studio. ## How do I fix CVE-2025-25297? Upgrade label-studio to 1.16.0 or later. ## Is CVE-2025-25297 being exploited? It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-25297 exists. ## Other vulnerabilities in HumanSignal label-studio - [CVE-2023-43791](https://insights.sbomify.com/CVE-2023-43791/): Label Studio has Hardcoded Django `SECRET_KEY` that can be Abused to Forge Session Tokens (critical 9.8) - [CVE-2026-22033](https://insights.sbomify.com/CVE-2026-22033/): Label Studio vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field (high 8.6) - [CVE-2025-47783](https://insights.sbomify.com/CVE-2025-47783/): label-studio vulnerable to Cross-Site Scripting (Reflected) via the label_config parameter. (high 7.6) - [CVE-2023-47117](https://insights.sbomify.com/CVE-2023-47117/): Object Relational Mapper Leak Vulnerability in Filtering Task in Label Studio (high 7.5) - [CVE-2023-47115](https://insights.sbomify.com/CVE-2023-47115/): Label Studio XSS Vulnerability on Avatar Upload (high 7.1) ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2025-25297 and fix it if it is affected. What it is: CVE-2025-25297 is a high-severity server-side request forgery vulnerability in HumanSignal label-studio, published on 14 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim. Exploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-25297 exists. Affected packages and fixed versions: - label-studio (PyPI): affected all versions; fixed in 1.16.0 - label-studio (PyPI): affected all versions; fixed in 1.16.0 - label-studio (PyPI): affected all versions; fixed in 1.16.0 Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2025-25297/ (Markdown: https://insights.sbomify.com/CVE-2025-25297/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2025-25297 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-25297 - OSV: https://osv.dev/vulnerability/CVE-2025-25297 --- From sbomify Insights: https://insights.sbomify.com/CVE-2025-25297/ Summaries are generated and may contain mistakes; the official description above is the record.