Description

FiftyOne is an open-source platform for refining high-quality datasets and visual AI models. Prior to 1.17.0, the FiftyOne App/API server in fiftyone/server/app.py and the /media route in fiftyone/server/routes/media.py unconditionally return Access-Control-Allow-Origin: *. Because the embedded server is local and unauthenticated, a malicious website visited by the user can read cross-origin responses. The /media endpoint accepts a filesystem path, allowing a drive-by page to read files accessible to the server process and exfiltrate them without additional clicks. The allowed_origins configuration and FIFTYONE_ALLOWED_ORIGINS environment variable now make cross-origin access explicit, while the default policy is same-origin. This issue is fixed in version 1.17.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-21T21:17:00.113Z",
  "pubdate": "2026-08-21T21:17:00.113Z",
  "executiveSummary": "A Cross-Origin Resource Sharing (CORS) misconfiguration exists in the FiftyOne platform prior to version 1.17.0, specifically within the FiftyOne App/API server and associated media routing components. The vulnerability stems from the unconditional return of the Access-Control-Allow-Origin: * header combined with an unauthenticated local server architecture. This security defect enables a malicious website, when visited by a user running the local server, to execute cross-origin requests and read sensitive responses without user interaction.\nThe primary impact involves unauthorized arbitrary file read capabilities. Because the /media endpoint accepts arbitrary filesystem paths, an external attacker can construct a drive-by attack that traverses and reads files accessible to the server process, subsequently exfiltrating them across origins. The attack requires the victim to visit a malicious website while running the vulnerable local FiftyOne instance, presenting severe privacy and data exposure risks to local environments.",
  "technicalDetails": "The vulnerability resides in fiftyone/server/app.py and the /media route defined in fiftyone/server/routes/media.py. Prior to version 1.17.0, the application unconditionally returns the HTTP header Access-Control-Allow-Origin: * on responses served by the FiftyOne App/API server.\nThe affected component is exposed via a local embedded server operating without authentication mechanisms. The /media endpoint is engineered to accept a filesystem path parameter, allowing retrieval of media assets directly from the host system. Due to the overly permissive CORS policy, web browsers executing a script on an arbitrary external website can issue cross-origin requests to the local server endpoint (e.g., http://localhost:<port>/media) and successfully bypass the Same-Origin Policy.\nThe step-by-step attack flow proceeds as follows: First, a user launches the vulnerable FiftyOne server locally. Second, the user browses to a malicious website controlled by an attacker. Third, JavaScript executing within the malicious webpage issues an asynchronous cross-origin HTTP request to the local FiftyOne server instance targeting the /media route with a crafted filesystem path. Fourth, because the server returns Access-Control-Allow-Origin: *, the browser permits the malicious script to read the response payload. Fifth, the endpoint processes the filesystem path, reads the targeted local file accessible to the server process, and returns its contents in the HTTP response. Finally, the malicious script captures the file contents and exfiltrates them to the attacker's infrastructure.\nThe vulnerability requires no authentication or special privileges on the local server, as the server architecture runs unauthenticated by default. Network exposure is localized to the host interface where the server binds, but browser-based drive-by attacks bridge the isolation gap. Affected versions include all instances prior to 1.17.0."
}