Live › vulnerability › CVE-2026-111618
Go to dashboardCoAI (Chat Nio) through 4.0.0 has a path traversal flaw in its generation and article archive download endpoints, controlled by the hash query parameter. An unauthenticated attacker can use ../ sequences in hash to download any readable .tar.gz or .zip file, including other users' generated archives.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted CoAI (Chat Nio) 4.0.0 or earlier is exposed through four unauthenticated routes: /generation/download/tar, /generation/download/zip, /article/download/tar and /article/download/zip. An attacker can use ../ in the hash parameter to read any .tar.gz or .zip file the CoAI process can read, including other users' generated archives. Other file types (config, keys, /etc/passwd) cannot be read this way. Teams not running CoAI can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| coai | github | <= 4.0.0 | – |
4.0.0 or earlier? Check the versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
CoAI (Chat Nio) through 4.0.0 contains an unauthenticated path traversal vulnerability in the generation and article archive download endpoints via the hash query parameter. Attackers can supply ../ sequences in hash to download any readable .tar.gz or .zip file, including other users' generated archives.
This page as .md · .json · in your agent: get_signal("CVE-2026-111618")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.