Vulnerability · Published Oct 16, 2026 · Assigned by VulnCheck

CVE-2026-111618CoAI through 4.0.0 Unauthenticated Path Traversal via Archive Download Endpoints

Medium 5.3

In plain English

A medium-severity path traversal in CoAI from coaidev. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.4%top 62.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

CoAI (Chat Nio) through 4.0.0 contains an unauthenticated path traversal vulnerability in the generation and article archive download endpoints via the hash query parameter. Attackers can supply ../ sequences in hash to download any readable .tar.gz or .zip file, including other users' generated archives.

Affected products (as reported)

Vendor	Product	Versions
coaidev	CoAI	0 – through 4.0.0

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://hackmd.io/@hieuPenguinnn/coai-chatnio-generation-article-download-path-traversal third-party-advisory
https://github.com/coaidev/coai/blob/v4.0.0/addition/generation/api.go#L19-L29 technical-description
https://github.com/coaidev/coai/blob/v4.0.0/addition/article/api.go#L25-L35 technical-description
VulnCheck Advisory: CoAI through 4.0.0 Unauthenticated Path Traversal via Archive Download Endpoints third-party-advisory