{"action":"Upgrade label-studio to 1.7.2 or later.","affected":[{"fixed":"1.7.2","introduced":"0"}],"component":"label-studio","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":["1.7.2"],"ghsa_id":"GHSA-cpmr-mw4j-99r7","id":"tcs_01M5KFDDES9X9TEDNYC7195X4W","modified_at":"2026-09-02T22:15:05.256826536Z","published_at":"2023-03-24T22:04:02Z","references":["https://osv.dev/vulnerability/GHSA-cpmr-mw4j-99r7","https://github.com/heartexlabs/label-studio/security/advisories/GHSA-cpmr-mw4j-99r7","https://github.com/HumanSignal/label-studio/commit/60a3ef57a22c50d7230a56c11d85e14454c99a28","https://github.com/heartexlabs/label-studio","https://github.com/heartexlabs/label-studio/blob/53944e6bcede75ca5c102d655013f2e5238e85e6/deploy/default.conf#L119"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-cpmr-mw4j-99r7","url":"https://osv.dev/vulnerability/GHSA-cpmr-mw4j-99r7"}],"summary":"Nginx alias path traversal allows unauthenticated attackers to read all files on /label_studio/core/"}