CVE-2026-111618: CoAI through 4.0.0 Unauthenticated Path Traversal via Archive Download Endpoints
CoAI (Chat Nio) through 4.0.0 contains an unauthenticated path traversal vulnerability in the generation and article archive download endpoints via the hash query parameter. Attackers can supply ../ sequences in hash to download any readable .tar.gz or .zip file, including other users' generated archives.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any remote attacker can exploit it without authentication or user interaction, provided they can reach the affected CoAI archive download endpoints.
What files can an attacker obtain?
An attacker can use ../ sequences in the hash query parameter to download readable .tar.gz or .zip files outside the intended archive location. This includes generated archives belonging to other users.
Are integrity or availability affected?
The available assessment indicates confidentiality impact only: attackers can read accessible archive files, with no stated ability to modify data or disrupt service.
How can defenders identify attempted exploitation?
Inspect requests to the generation and article archive download endpoints for hash query parameter values containing ../ traversal sequences.