CVE-2026-69110 Details
Description
OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the temp and static/music directories by directly accessing the GET /api/tmp/:tmpFile and GET /api/music/:fileName endpoints. Attackers can retrieve intermediate audio, video artifacts, and subtitles belonging to other users' jobs, and additionally delete any video by ID through the unauthenticated DELETE /api/short-video/:videoId endpoint.
A missing authentication vulnerability has been identified in OpenCode Studio versions prior to 2.4.4. This vulnerability allows unauthenticated remote attackers to read arbitrary files from the temporary and static/music directories. The issue arises from the lack of authentication on the GET /api/tmp/:tmpFile and GET /api/music/:fileName endpoints, which serve files directly without any access controls. Attackers can exploit this to access intermediate audio and video artifacts, as well as subtitles from other users' jobs. Additionally, the vulnerability allows for the deletion of any video by ID through the unauthenticated DELETE /api/short-video/:videoId endpoint.
Users are advised to update OpenCode Studio to version 2.4.4 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 4, 2026CISA-ADP
Assessed Aug 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Microck/opencode-studio/commit/1f4d7a7f52beb43105d345b26fd0c0ffc2bf0004 | [email protected] | Source CodeVendor |
| https://github.com/Microck/opencode-studio/issues/54 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/Microck/opencode-studio/pull/55 | [email protected] | Issue TrackingVendor |
| https://github.com/Microck/opencode-studio/releases/tag/v2.4.4 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/opencode-studio-unauthenticated-file-read-via-api-tmp-and-api-music | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Microck OpenCode Studio | < 2.4.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 4, 2026 | CVE Modified | CISA-ADP |
| Aug 4, 2026 | New CVE Received | [email protected] |