The FiftyOne App/API server and its /media route unconditionally set Access-Control-Allow-Origin: * headers, allowing any website to read responses from the local server. Since the /media endpoint serves files from the local filesystem without authentication, this enables a remote attacker to read arbitrary local files by issuing cross-origin requests from a malicious webpage. The vulnerability affects users running the FiftyOne server locally while browsing the web. Browsers with Private Network Access protections mitigate this for some users, but others remain vulnerable. The issue is fixed in FiftyOne 1.17.0 by removing the wildcard CORS header and requiring explicit allowed origins configuration for cross-origin access.

An attacker can exploit this vulnerability to read arbitrary files accessible to the local FiftyOne server process by tricking a user into visiting a malicious website. This can lead to disclosure of sensitive local files such as SSH keys, cloud credentials, environment files, and dataset media. The attack requires no user interaction beyond visiting a malicious page and only affects users running the vulnerable FiftyOne server locally. Cloud-stored media served via signed URLs on separate origins are not affected.

A fix is available in FiftyOne version 1.17.0 and later, which removes the wildcard CORS header and restricts responses to same-origin by default. Cross-origin access is now opt-in via an explicit allowed origins configuration. Users should upgrade to FiftyOne 1.17.0 or later to remediate this vulnerability. Until upgrading, users should avoid running the FiftyOne App server while browsing untrusted websites, keep the server bound to localhost, and use browsers that enforce Private Network Access protections.