CVE-2026-111618 in CoAI
Summary
by MITRE • 10/16/2026
CoAI (Chat Nio) through 4.0.0 contains an unauthenticated path traversal vulnerability in the generation and article archive download endpoints via the hash query parameter. Attackers can supply ../ sequences in hash to download any readable .tar.gz or .zip file, including other users' generated archives.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/16/2026
The CoAI application, specifically versions up through 4.0.0, suffers from a critical unauthenticated path traversal vulnerability that affects the integrity and confidentiality of user-generated content. This flaw is located within the endpoints responsible for generating reports or articles as well as downloading article archives. The core technical issue stems from improper validation of input provided via the hash query parameter. When an attacker supplies directory traversal sequences, such as ../, into this parameter, the application fails to sanitize or canonicalize the path before processing it. This lack of rigorous input validation allows the underlying file system operations to resolve paths outside of the intended secure directory structure. Consequently, the vulnerability enables arbitrary file read access across the server's filesystem, provided that the target files are readable by the service account executing the CoAI application and exist in formats compatible with the download mechanism, specifically .tar.gz or .zip archives.
From a technical perspective, this is a classic instance of CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The vulnerability arises because the application trusts user-supplied input without verifying that the resolved path remains within an expected sandboxed directory. By manipulating the hash parameter with relative path traversal characters, an attacker can break out of the designated archive storage location and access sensitive files elsewhere on the system. This behavior is particularly dangerous in a multi-tenant or shared-user environment because it allows one user to potentially download archives belonging to other users if those archives are stored in accessible locations within the filesystem hierarchy. The attack does not require authentication, which significantly lowers the barrier for exploitation and increases the likelihood of automated scanning tools detecting and exploiting this weakness against exposed instances.
The operational impact of this vulnerability is severe regarding data confidentiality and potential downstream risks. Attackers can exfiltrate sensitive information contained within any readable archive file on the server. This includes proprietary documents, personal identifiable information, or internal configuration files that may have been packaged into archives by legitimate users or system processes. If these extracted archives contain further nested vulnerabilities or malicious payloads, they could serve as a vector for subsequent attacks against other systems in the network. Furthermore, the ability to read arbitrary files can aid attackers in mapping out the server environment, identifying additional software versions, and discovering credentials or keys stored within configuration files that might be archived elsewhere on the disk. This aligns with ATT&CK technique T1083: File and Directory Discovery, as it facilitates reconnaissance of the target system's file structure to support further exploitation phases such as data exfiltration (T1567).
To mitigate this vulnerability, immediate remediation is required by updating CoAI to a version where this issue has been patched. In versions prior to 4.0.0 or if an update is not immediately available, administrators should implement strict input validation on the hash query parameter. This involves ensuring that only expected alphanumeric characters are accepted and rejecting any input containing path traversal sequences like ../ or ..\ regardless of encoding attempts. Additionally, implementing a whitelist approach for allowed file extensions can prevent the download of unexpected archive types. From an infrastructure perspective, deploying the application with least-privilege principles is essential; the service account should have restricted read access limited strictly to its own working directories and never granted broad filesystem permissions. Web Application Firewalls (WAFs) configured with rules targeting path traversal patterns in query parameters can also provide a layer of defense-in-depth by blocking malicious requests before they reach the application logic, although this should not be relied upon as the primary fix for such fundamental code flaws.