Vulnerability · Published Oct 14, 2026 · Assigned by VulnCheck
CVE-2026-110766Colanode Server through 0.4.7 Path Traversal via Avatar Download Route
Medium 4.3
In plain English
A medium-severity path traversal in colanode from colanode. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.3%top 78.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Colanode server through 0.4.7 contains a path traversal vulnerability that allows authenticated users to read arbitrary .jpeg files by supplying an encoded traversal sequence in avatarId. Attackers can send percent-encoded ../ sequences to GET /client/v1/avatars/:avatarId to escape the avatars directory and read .jpeg files belonging to other workspaces.
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
- https://hackmd.io/@hieuPenguinnn/colanode-avatar-download-path-traversal technical-description, exploit
- https://github.com/colanode/colanode/blob/d649523637f0f059c936418488165d4a689da27c/apps/server/src/lib/storage/fs.ts#L38 technical-description
- https://github.com/colanode/colanode/blob/d649523637f0f059c936418488165d4a689da27c/apps/server/src/api/client/routes/avatars/avatar-download.ts#L23 technical-description
- https://github.com/colanode/colanode product
- VulnCheck Advisory: Colanode Server through 0.4.7 Path Traversal via Avatar Download Route third-party-advisory