CVE-2026-110766
MEDIUMCVSS 4.3Description
Colanode server through 0.4.7 contains a path traversal vulnerability that allows authenticated users to read arbitrary .jpeg files by supplying an encoded traversal sequence in avatarId. Attackers can send percent-encoded ../ sequences to GET /client/v1/avatars/:avatarId to escape the avatars directory and read .jpeg files belonging to other workspaces.
Timeline
Published:October 14th, 2026 7:17 PM
Last modified:October 15th, 2026 2:47 PM
CVSS Scoring
CVSS v3: 4.3 (MEDIUM)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses (CWE)
References & Reports
Advisories, patches, and third-party reports
- https://github.com/colanode/colanode
- https://github.com/colanode/colanode/blob/d649523637f0f059c936418488165d4a689da27c/apps/server/src/api/client/routes/avatars/avatar-download.ts#L23
- https://github.com/colanode/colanode/blob/d649523637f0f059c936418488165d4a689da27c/apps/server/src/lib/storage/fs.ts#L38
- https://hackmd.io/@hieuPenguinnn/colanode-avatar-download-path-traversal
- https://www.vulncheck.com/advisories/colanode-server-through-0.4.7-path-traversal-via-avatar-download-route
Source: NIST NVD · Data may lag official sources by up to one minute