Coai
Monthly
Unauthenticated path traversal in CoAI (Chat Nio) through 4.0.0 lets remote attackers download arbitrary readable .tar.gz or .zip archives, including archives generated by other users, by injecting ../ sequences into the hash query parameter of the generation and article archive download endpoints. The flaw is remotely exploitable without credentials against default configurations (CVSS 4.0 vector PR:N, consistent with the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N), but the impact is confidentiality-only: only files readable by the service process and matching an archive extension can be retrieved, and there is no write or code-execution capability. No public exploit identified at time of analysis and no CISA KEV listing; the issue remains a moderate-severity information-disclosure risk on exposed instances.
Unauthenticated path traversal in CoAI (Chat Nio) through 4.0.0 lets remote attackers download arbitrary readable .tar.gz or .zip archives, including archives generated by other users, by injecting ../ sequences into the hash query parameter of the generation and article archive download endpoints. The flaw is remotely exploitable without credentials against default configurations (CVSS 4.0 vector PR:N, consistent with the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N), but the impact is confidentiality-only: only files readable by the service process and matching an archive extension can be retrieved, and there is no write or code-execution capability. No public exploit identified at time of analysis and no CISA KEV listing; the issue remains a moderate-severity information-disclosure risk on exposed instances.