---
id: "CVE-2026-111618"
kind: "vulnerability"
aliases: ["CVE-2026-111618"]
title: "CoAI Chat Nio: unauthenticated path traversal reads archive files"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "coai", "fixed": [], "affected": "<= 4.0.0", "ecosystem": "github"}]
ecosystems: []
tags: ["ai-chat", "ai-tooling", "chat-nio", "coai", "path-traversal", "self-hosted", "unauthenticated"]
not_affected_if: ["not-running-coai", "routes-blocked-at-proxy"]
published_at: "2026-10-16T18:17:41+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T03:43:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111618", "first_seen_at": "2026-10-23T21:57:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:43:29+00:00"}]
---

# CoAI Chat Nio: unauthenticated path traversal reads archive files

CoAI (Chat Nio) through 4.0.0 has a path traversal flaw in its generation and article archive download endpoints, controlled by the hash query parameter. An unauthenticated attacker can use ../ sequences in hash to download any readable .tar.gz or .zip file, including other users' generated archives.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:coai affected <= 4.0.0 fixed ?

## How to check

Run CoAI/Chat Nio (coaidev/coai) 4.0.0 or earlier? Check the version. Then test whether GET /generation/download/tar?hash=x and /article/download/zip?hash=x answer without a token (404 or empty body, not 401). Look in proxy logs for hash= values containing ../ or %2e%2e on those four routes.

## Fix

No fixed release known as of 2026-10-25. Until one ships, block /generation/download/{tar,zip} and /article/download/{tar,zip} at the reverse proxy or require auth there. Upstream PR coaidev/coai#397 is open and not merged; it covers only the article routes.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111618
- 2026-10-25T03:43:29+00:00 analyst — Read VulnCheck advisory, researcher write-up (static review only, PoC not run), upstream PR #397 (open, unmerged, covers only article routes). No fixed release found; affected through 4.0.0. Not marked verified: no vendor advisory.

## Documents

- [advisory] VulnCheck: CoAI through 4.0.0 path traversal via archive download endpoints https://www.vulncheck.com/advisories/coai-through-4.0.0-unauthenticated-path-traversal-via-archive-download-endpoints
- [describes] hieuPenguinnn write-up (static review, PoC not executed) https://hackmd.io/@hieuPenguinnn/coai-chatnio-generation-article-download-path-traversal
- [mentions] coaidev/coai PR #397 (open, unmerged): prevent path traversal in article download https://github.com/coaidev/coai/pull/397

## From the sources

CoAI (Chat Nio) through 4.0.0 contains an unauthenticated path traversal vulnerability in the generation and article archive download endpoints via the hash query parameter. Attackers can supply ../ sequences in hash to download any readable .tar.gz or .zip file, including other users' generated archives.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_