CVE-2026-111618 CoAI through 4.0.0 Unauthenticated Path Traversal via Archive Download Endpoints
Unauthenticated attackers can exploit path traversal in archive download endpoints to read arbitrary files, including other users' data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-111618?
CVE-2026-111618 is a medium-severity path traversal vulnerability in coaidev CoAI, published on 16 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CoAI (Chat Nio) through 4.0.0 contains an unauthenticated path traversal vulnerability in the generation and article archive download endpoints via the hash query parameter. Attackers can supply ../ sequences in hash to download any readable .tar.gz or .zip file, including other users' generated archives.
Weakness: CWE-22
Which versions are affected by CVE-2026-111618?
How do I fix CVE-2026-111618?
No fix has been published for CVE-2026-111618 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-111618 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-111618 exists.
Sources
Also known as GHSA-r2h8-g3f5-9cw2.