Read the docs
TI-2025-38649 Aliases CVE-2025-62382

Frigate Vulnerable to Arbitrary File Read via Export Thumbnail "image_path" parameter

Priority HIGH 67CWE-73Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-73 and the CVSS impact.

Summary

Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Prior to 0.16.2, Frigate's export workflow allows an authenticated operator to nominate any filesystem location as the thumbnail source for a video export. Because that path is copied verbatim into the publicly served clips directory, the feature can be abused to read arbitrary files that reside on the host running Frigate. In practice, a low-privilege user with API access can pivot from viewing camera footage to exfiltrating sensitive configuration files, secrets, or user data from the appliance itself. This behavior violates the principle of least privilege for the export subsystem and turns a convenience feature into a direct information disclosure vector, with exploitation hinging on a short race window while the background exporter copies the chosen file into place before cleanup runs. This vulnerability is fixed in 0.16.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00398 34th percentileScored 2026-11-07
Fix Fixed frigate (blakeblackshear): 0.16.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
blakeblackshearfrigatebefore 0.16.20.16.2Patch availableCNA
  • frigate Vendorblakeblackshear Affected before 0.16.2 Fixed in 0.16.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:frigate:frigate:*:*:*:*:*:*:*:*——blakeblackshear
  • cpe:2.3:a:frigate:frigate:*:*:*:*:*:*:*:* Versions — — ·blakeblackshear

Remediation

  • Fix · CNA frigate (blakeblackshear) Fixed in 0.16.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-62382

References

Other 2

  • TI-2026-20743 Frigate Affected by Authenticated Remote Command Execution (RCE) and Container Escape CVSS 3.1CRITICAL 9.1
  • TI-2026-39479 Frigate viewer can read logs exposing admin and camera credentials CVSS 3.1HIGH 8.1
  • TI-2026-52911 Frigate: WebSocket Missing Authorization — Viewer Can Execute Admin-Only Operations CVSS 3.1HIGH 8.1
  • TI-2026-25557 Frigate Broken Access Control: Users assigned the viewer role can delete admin and other low-privileged accounts CVSS 3.1HIGH 8.1
  • TI-2026-52912 Frigate: Viewer-Role User Can Access go2rtc Internal API to obtain sensitive information CVSS 3.1HIGH 7.7
  • TI-2026-25866 Missing authorization in blakeblackshear frigate CVSS 3.1MEDIUM 6.5
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences