CVE-2026-111618 Details
Description
CoAI (Chat Nio) through 4.0.0 contains an unauthenticated path traversal vulnerability in the generation and article archive download endpoints via the hash query parameter. Attackers can supply ../ sequences in hash to download any readable .tar.gz or .zip file, including other users' generated archives.
A path traversal vulnerability has been identified in CoAI (Chat Nio) versions through 4.0.0. This vulnerability allows unauthenticated users to manipulate the hash query parameter in the generation and article archive download endpoints. By inserting ../ sequences, attackers can traverse the file system and download any accessible .tar.gz or .zip file, including archives generated by other users.
It is recommended to validate the hash parameter to ensure it does not contain path traversal sequences, and to require authentication and ownership verification for the download routes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@hieuPenguinnn/coai-chatnio-generation-article-download-path-traversal | CISA-ADP | ExploitTechnical Analysis |
| https://github.com/coaidev/coai/blob/v4.0.0/addition/article/api.go#L25-L35 | [email protected] | Source CodeVendor |
| https://github.com/coaidev/coai/blob/v4.0.0/addition/generation/api.go#L19-L29 | [email protected] | Source CodeVendor |
| https://hackmd.io/@hieuPenguinnn/coai-chatnio-generation-article-download-path-traversal | [email protected] | ExploitTechnical Analysis |
| https://www.vulncheck.com/advisories/coai-through-4.0.0-unauthenticated-path-traversal-via-archive-download-endpoints | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| CoAI | <= 4.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 23, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |