CVE-2025-25295: Label Studio has a Path Traversal Vulnerability via image Field

def download(
url,
output_dir,
filename=None,
project_dir=None,
return_relative_path=False,
upload_dir=None,
download_resources=True,
):
is_local_file = url.startswith("/data/") and "?d=" in url
is_uploaded_file = url.startswith("/data/upload")

if is_uploaded_file:
upload_dir = _get_upload_dir(project_dir, upload_dir)
filename = urllib.parse.unquote(url.replace("/data/upload/", ""))
filepath = os.path.join(upload_dir, filename)
logger.debug(
f"Copy {filepath} to {output_dir}".format(
filepath=filepath, output_dir=output_dir
)
)
if download_resources:
shutil.copy(filepath, output_dir)
if return_relative_path:
return os.path.join(
os.path.basename(output_dir), os.path.basename(filename)
)
return filepath

if is_local_file:
filename, dir_path = url.split("/data/", 1)[-1].split("?d=")
dir_path = str(urllib.parse.unquote(dir_path))
filepath = os.path.join(LOCAL_FILES_DOCUMENT_ROOT, dir_path)
if not os.path.exists(filepath):
raise FileNotFoundError(filepath)
if download_resources:
shutil.copy(filepath, output_dir)
return filepath