CVE-2025-25295: Label Studio Path Traversal via Image Field in Export

Label Studio is an open source data labeling tool. Its VOC, COCO and YOLO export paths call a download function in the label-studio-sdk package to fetch task images, and that function does not validate the path it is given.

An authenticated user creates a task whose image field contains traversal sequences, then exports the project. The export reads arbitrary files from the server and bundles them into the output. Label Studio 1.16.0 pins SDK 1.0.10, which fixes the issue.