CVE-2026-69110: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Microck opencode-studio
OpenCode Studio versions prior to 2.4.4 contain a critical vulnerability allowing unauthenticated remote attackers to read arbitrary files in certain directories and delete videos by ID via unauthenticated API endpoints. This missing authentication flaw exposes intermediate audio, video, and subtitle files belonging to other users, posing significant confidentiality and integrity risks.
AI Analysis
Technical Summary
CVE-2026-69110 is a critical missing authentication vulnerability in OpenCode Studio before version 2.4.4. It allows unauthenticated remote attackers to access sensitive files within the temp and static/music directories by directly invoking GET requests on /api/tmp/:tmpFile and /api/music/:fileName endpoints. Additionally, attackers can delete any video by ID using the unauthenticated DELETE /api/short-video/:videoId endpoint. This improper limitation of pathname access leads to unauthorized file disclosure and deletion.
Potential Impact
Attackers can read arbitrary files related to other users' jobs, including intermediate audio, video artifacts, and subtitles, compromising confidentiality. They can also delete any video by ID without authentication, impacting data integrity and availability. The vulnerability requires no privileges or user interaction and is remotely exploitable, resulting in a high-severity impact on affected systems.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict external access to the affected API endpoints and implement authentication controls to prevent unauthenticated access. Monitor for unusual deletion activity and unauthorized file access attempts.
CVE-2026-69110: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Microck opencode-studio
Description
OpenCode Studio versions prior to 2.4.4 contain a critical vulnerability allowing unauthenticated remote attackers to read arbitrary files in certain directories and delete videos by ID via unauthenticated API endpoints. This missing authentication flaw exposes intermediate audio, video, and subtitle files belonging to other users, posing significant confidentiality and integrity risks.
CVSS v4.0
Score 9.3critical
Affected software
Microck
opencode-studio
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-69110 is a critical missing authentication vulnerability in OpenCode Studio before version 2.4.4. It allows unauthenticated remote attackers to access sensitive files within the temp and static/music directories by directly invoking GET requests on /api/tmp/:tmpFile and /api/music/:fileName endpoints. Additionally, attackers can delete any video by ID using the unauthenticated DELETE /api/short-video/:videoId endpoint. This improper limitation of pathname access leads to unauthorized file disclosure and deletion.
Potential Impact
Attackers can read arbitrary files related to other users' jobs, including intermediate audio, video artifacts, and subtitles, compromising confidentiality. They can also delete any video by ID without authentication, impacting data integrity and availability. The vulnerability requires no privileges or user interaction and is remotely exploitable, resulting in a high-severity impact on affected systems.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict external access to the affected API endpoints and implement authentication controls to prevent unauthenticated access. Monitor for unusual deletion activity and unauthorized file access attempts.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-03T13:26:21.233Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a72084dbf8831d5390c1582
Added to database: 08/04/2026, 15:42:05 UTC
Last enriched: 08/11/2026, 18:20:06 UTC
Last updated: 09/17/2026, 22:01:37 UTC
Views: 63
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.