{"schema":"threatline.record/2","record":{"id":"CVE-2026-110766","aliases":[],"summary":"Colanode Server through 0.4.7 Path Traversal via Avatar Download Route","details":"Colanode server through 0.4.7 contains a path traversal vulnerability that allows authenticated users to read arbitrary .jpeg files by supplying an encoded traversal sequence in avatarId. Attackers can send percent-encoded ../ sequences to GET /client/v1/avatars/:avatarId to escape the avatars directory and read .jpeg files belonging to other workspaces.","categories":["Unclassified"],"product":"colanode","vendor":"colanode","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-110766","source_modified_at":"2026-10-14T19:38:51.634Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"colanode","vendor":"colanode","versions":[{"version":"0","lessThanOrEqual":"0.4.7","status":"affected","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":5.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00286,"percentile":0.2003,"score_date":"2026-10-23"},"published_at":"2026-10-14T18:47:43.182Z","modified_at":"2026-10-14T19:38:51.634Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-110766","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-14T19:38:51.634Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110766","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://hackmd.io/@hieuPenguinnn/colanode-avatar-download-path-traversal","tags":["technical-description","exploit"]},{"source":"CVE List","url":"https://github.com/colanode/colanode/blob/d649523637f0f059c936418488165d4a689da27c/apps/server/src/lib/storage/fs.ts#L38","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/colanode/colanode/blob/d649523637f0f059c936418488165d4a689da27c/apps/server/src/api/client/routes/avatars/avatar-download.ts#L23","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/colanode/colanode","tags":["product"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/colanode-server-through-0.4.7-path-traversal-via-avatar-download-route","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-14T19:38:39.974504Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-14T19:38:51.634Z","content_hash":"9c38ab8ac51f9a229e15a379c3ee7c2f17aa74807647a8b457bd663436e4e929"}}