Colanode EUVD-2026-101566

Requires a valid authenticated account on the Colanode server (PR:L) and a multi-workspace/multi-tenant deployment for cross-workspace data to exist. The attacker sends a percent-encoded ../ traversal sequence in the avatarId parameter of GET /client/v1/avatars/:avatarId to escape the avatars storage directory. Exploitation is LIMITED to reading files with a .jpeg extension, so it cannot retrieve arbitrary configuration or credential files; no user interaction is needed, but authentication is mandatory and the attacker benefits from knowing or guessing relative paths to target workspaces' image assets.

This is a moderate, constrained information-disclosure issue rather than a top-tier priority. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) is internally consistent with the description: network-reachable, low-complexity, but requiring authentication (PR:L) and yielding only low confidentiality impact with no integrity or availability impact. No EPSS score was provided, the CVE is not listed in CISA KEV, and no weaponized public exploit is identified in the structured input - so there is no public exploit identified at time of analysis, though a third-party technical write-up (hackmd) and a VulnCheck advisory with source-code line references exist, which materially lowers the bar for an attacker to reproduce it. The real-world ceiling is low: an authenticated user can read only .jpeg files belonging to other workspaces, so the practical impact is leakage of avatar/image assets across tenant boundaries, not full file-system compromise. Signals are consistent (no conflicts between CVSS, description, and exploitation status); the main missing data are EPSS and any vendor-confirmed fixed version.

An authenticated low-privilege user of a multi-tenant Colanode server crafts a percent-encoded ../ traversal sequence in the avatarId path parameter and issues GET /client/v1/avatars/:avatarId, escaping the avatars directory to read .jpeg files stored for other workspaces. No public weaponized exploit is identified, but a detailed technical write-up and advisory with the vulnerable source lines (avatar-download.ts, fs.ts) are published, making reproduction straightforward. Because CVSS is AC:L with network attack vector, exploitation is trivial once a valid account exists.