Threats tagged 'ghsa-r2h8-g3f5-9cw2'

CoAI (Chat Nio) versions up to 4.0.0 contain an unauthenticated path traversal vulnerability in the generation and article archive download endpoints. Attackers can exploit the hash query parameter by including ../ sequences to download any readable .tar.gz or .zip file on the server, including archives generated by other users. This vulnerability allows unauthorized access to potentially sensitive files without requiring authentication.