CVE-2026-111618: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in coaidev CoAI

CVE-2026-111618 describes an unauthenticated path traversal vulnerability in CoAI (Chat Nio) through version 4.0.0. The issue exists in the generation and article archive download endpoints where the hash query parameter is improperly sanitized, allowing attackers to traverse directories by injecting '../' sequences. This enables unauthorized download of arbitrary readable .tar.gz or .zip files, including other users' generated archives. The vulnerability has a CVSS 4.0 score of 6.9 (medium severity) and does not require privileges or user interaction to exploit.

An attacker can exploit this vulnerability to download arbitrary readable archive files from the server without authentication. This may lead to unauthorized disclosure of sensitive user-generated content or other files accessible to the application process. There is no indication of remote code execution or privilege escalation from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoints, implement input validation to sanitize the hash parameter, or apply web application firewall rules to block path traversal patterns.