{"id":"CVE-2026-111618","kind":"vulnerability","aliases":["CVE-2026-111618"],"related":[],"title":"CoAI Chat Nio: unauthenticated path traversal reads archive files","description":"CoAI (Chat Nio) through 4.0.0 contains an unauthenticated path traversal vulnerability in the generation and article archive download endpoints via the hash query parameter. Attackers can supply ../ sequences in hash to download any readable .tar.gz or .zip file, including other users' generated archives.","summary":"CoAI (Chat Nio) through 4.0.0 has a path traversal flaw in its generation and article archive download endpoints, controlled by the hash query parameter. An unauthenticated attacker can use ../ sequences in hash to download any readable .tar.gz or .zip file, including other users' generated archives.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"coai","fixed":[],"affected":"<= 4.0.0","ecosystem":"github"}],"ecosystems":[],"tags":["ai-chat","ai-tooling","chat-nio","coai","path-traversal","self-hosted","unauthenticated"],"not_affected_if":["not-running-coai","routes-blocked-at-proxy"],"how_to_check":"Run CoAI/Chat Nio (coaidev/coai) 4.0.0 or earlier? Check the version. Then test whether GET /generation/download/tar?hash=x and /article/download/zip?hash=x answer without a token (404 or empty body, not 401). Look in proxy logs for hash= values containing ../ or %2e%2e on those four routes.","fix":"No fixed release known as of 2026-10-25. Until one ships, block /generation/download/{tar,zip} and /article/download/{tar,zip} at the reverse proxy or require auth there. Upstream PR coaidev/coai#397 is open and not merged; it covers only the article routes.","status":"open","published_at":"2026-10-16T18:17:41+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:42:28+00:00","updated_at":"2026-10-25T03:43:29+00:00","category":"ai-tooling","confidence":0.75,"triage":{"at":"2026-10-25T03:42:28Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"CoAI Chat Nio: unauthenticated path traversal reads archive files","impact":"medium","summary":"CoAI (Chat Nio) through 4.0.0 has a path traversal flaw in its generation and article archive download endpoints, controlled by the hash query parameter. An unauthenticated attacker can use ../ sequences in hash to download any readable .tar.gz or .zip file, including other users' generated archives.","category":"ai-tooling","nicknames":[],"who_cares":["coai","chat-nio","self-hosted","ai-chat"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker downloads any readable archive file, including other users' generated archives.","analyst_note":"Find the fixed CoAI version and the exact endpoint paths from the NVD record or the upstream repository.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["not-running-coai"],"who_is_affected":"CoAI (Chat Nio) deployments at version 4.0.0 or earlier that expose the generation or article archive download endpoints to the network. Sources do not name a fixed version. Instances not running CoAI can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000561,"input_tokens":3327,"output_tokens":456,"severity_before":"medium"},"analyst_status":"done","analyst_note":"Find the fixed CoAI version and the exact endpoint paths from the NVD record or the upstream repository.","search":"'-111618':12A,15A '-2026':11A,14A '4.0.0':38B,83C 'ai':18B,21B 'ai-chat':17B 'ai-tool':20B 'archiv':8A,49B,78B,95C,121C 'articl':48B,94C 'attack':60B,103C 'chat':2A,19B,24B,35B,80C 'chat-nio':23B 'coai':1A,16A,26B,34B,79C 'contain':84C 'control':52B 'cve':10A,13A 'download':50B,67B,96C,110C 'endpoint':51B,97C 'file':9A,73B,116C 'flaw':43B 'generat':46B,77B,92C,120C 'hash':55B,65B,100C,108C 'host':32B 'includ':74B,117C 'nio':3A,25B,36B,81C 'paramet':57B,102C 'path':5A,28B,41B,87C 'path-travers':27B 'queri':56B,101C 'read':7A 'readabl':69B,112C 'self':31B 'self-host':30B 'sequenc':63B,106C 'suppli':105C 'tar.gz':70B,113C 'tool':22B 'travers':6A,29B,42B,88C 'unauthent':4A,33B,59B,86C 'use':62B 'user':76B,119C 'via':98C 'vulner':89C 'zip':72B,115C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted CoAI (Chat Nio) 4.0.0 or earlier is exposed through four unauthenticated routes: /generation/download/tar, /generation/download/zip, /article/download/tar and /article/download/zip. An attacker can use ../ in the hash parameter to read any .tar.gz or .zip file the CoAI process can read, including other users' generated archives. Other file types (config, keys, /etc/passwd) cannot be read this way. Teams not running CoAI can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:41+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111618","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111618","severity":null,"published_at":"2026-10-16T18:17:41+00:00","modified_at":"2026-10-23T19:17:42+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111618:777","url":null,"severity":null,"published_at":"2026-10-25T03:43:29+00:00","modified_at":"2026-10-25T03:43:29+00:00","first_seen_at":"2026-10-25T03:43:29+00:00","fetched_at":"2026-10-25T03:43:29+00:00","note":"Read VulnCheck advisory, researcher write-up (static review only, PoC not run), upstream PR #397 (open, unmerged, covers only article routes). No fixed release found; affected through 4.0.0. Not marked verified: no vendor advisory."}],"documents":[{"id":3301,"url":"https://www.vulncheck.com/advisories/coai-through-4.0.0-unauthenticated-path-traversal-via-archive-download-endpoints","title":"VulnCheck: CoAI through 4.0.0 path traversal via archive download endpoints","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3302,"url":"https://hackmd.io/@hieuPenguinnn/coai-chatnio-generation-article-download-path-traversal","title":"hieuPenguinnn write-up (static review, PoC not executed)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":3303,"url":"https://github.com/coaidev/coai/pull/397","title":"coaidev/coai PR #397 (open, unmerged): prevent path traversal in article download","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}