CVE-2026-110766: Colanode Server through 0.4.7 Path Traversal via Avatar Download Route
Colanode server through 0.4.7 contains a path traversal vulnerability that allows authenticated users to read arbitrary .jpeg files by supplying an encoded traversal sequence in avatarId. Attackers can send percent-encoded ../ sequences to GET /client/v1/avatars/:avatarId to escape the avatars directory and read .jpeg files belonging to other workspaces.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user can exploit it remotely. The attacker must be able to send requests to the avatar download endpoint.
What does an attacker need to send?
The attacker supplies percent-encoded ../ traversal sequences in the avatarId path parameter of GET /client/v1/avatars/:avatarId. This can escape the avatars directory.
What data can be accessed?
The issue permits reading arbitrary .jpeg files, including .jpeg files associated with other workspaces. The provided information does not indicate access to non-JPEG files or file modification.
Are default deployments affected?
The provided information identifies Colanode Server through version 0.4.7 as affected, but does not state whether a particular configuration or deployment setting is required beyond authenticated access.