CVE-2026-7680 in COCO Annotator
Summary
by MITRE • 05/03/2026
A weakness has been identified in jsbroks COCO Annotator up to 0.11.1. Affected is an unknown function of the file backend/webserver/api/datasets.py of the component Data Endpoint. Executing a manipulation of the argument folder can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The jsbroks COCO Annotator vulnerability represents a critical path traversal flaw within the backend web server component that affects versions up to 0111. This weakness exists in the data endpoint functionality where the application fails to properly validate or sanitize user-supplied input parameters. The specific vulnerable function resides in backend/webserver/api/datasets.py and processes folder arguments without adequate security controls, creating an exploitable condition that allows attackers to manipulate file system paths through crafted input. The vulnerability is particularly concerning as it enables remote code execution capabilities when combined with other attack vectors.
The technical implementation of this flaw stems from improper input validation mechanisms within the dataset handling API endpoint. When the application processes folder parameter values, it does not adequately filter or sanitize the input before using it in file system operations. This allows attackers to inject directory traversal sequences such as ../ or ..\ that can navigate outside intended directories and access arbitrary files on the server. The vulnerability directly maps to CWE-23 Path Traversal and CWE-77 Path Traversal issues, which are classified under the Software Fault Patterns taxonomy. Attackers can leverage this weakness through the data endpoint API interface to execute path traversal attacks against the vulnerable system.
The operational impact of this vulnerability extends beyond simple information disclosure to encompass potential full system compromise. Remote attackers can exploit this weakness to access sensitive files including configuration data, database credentials, application source code, and other confidential resources stored on the server. The public availability of exploitation tools significantly increases the threat surface as malicious actors can readily deploy attacks against unpatched systems. This vulnerability represents a high-severity risk that could enable attackers to escalate privileges or establish persistent access within affected environments. The lack of vendor response to early disclosure attempts compounds the security risk by leaving organizations without timely remediation guidance.
Organizations utilizing jsbroks COCO Annotator should immediately implement mitigations including input validation controls, API rate limiting, and network segmentation to reduce exposure. The most effective immediate solution involves patching to version 0112 or later where the vulnerability has been addressed through proper parameter sanitization. Additional defensive measures include implementing web application firewalls with path traversal detection capabilities, restricting API access to trusted networks, and conducting thorough security audits of affected systems. From an ATT&CK framework perspective, this vulnerability maps to T1059 Command and Scripting Interpreter and T1566 Phishing techniques where attackers could leverage the exposed system for further reconnaissance activities. System administrators should monitor for unusual file access patterns and implement logging controls to detect potential exploitation attempts against the vulnerable API endpoints.