CVE-2026-110766 Details
Description
Colanode server through 0.4.7 contains a path traversal vulnerability that allows authenticated users to read arbitrary .jpeg files by supplying an encoded traversal sequence in avatarId. Attackers can send percent-encoded ../ sequences to GET /client/v1/avatars/:avatarId to escape the avatars directory and read .jpeg files belonging to other workspaces.
A path traversal vulnerability has been identified in Colanode server versions through 0.4.7. This vulnerability allows authenticated users to read arbitrary .jpeg files by sending an encoded traversal sequence in the avatarId parameter. The issue arises because the server does not properly validate the avatarId, enabling users to escape the designated avatars directory and access .jpeg files belonging to other workspaces. The vulnerability is present in the avatar download route of the Colanode server.
The vulnerability can be fixed by validating the avatarId parameter to ensure it conforms to the expected format and by implementing path containment checks in the filesystem storage backend to prevent traversal sequences from escaping the designated storage root.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Colanode | <= 0.4.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |