CoAI: an unauthenticated download reads other users' archives
A missing check on one query parameter turns CoAI's archive downloads into a reader for other people's files.
· VulnCheck · Research by hieuPenguinnn
CoAI through 4.0.0 builds a download path from a hash parameter it never checks, so an unauthenticated caller can send ../ and read any .tar.gz or .zip file the server reaches, including archives other users generated.
01What happened
VulnCheck published CVE-2026-111618 on 2026-10-16, an unauthenticated path traversal in CoAI, the self-hosted multi-model AI chat platform also shipped under the name Chat Nio. hieuPenguinnn found the flaw by reading the version 4.0.0 source and records the status as reported, with no vendor advisory published at the time of writing.
02How it works
Four download handlers in CoAI's addition module read the hash query parameter, trim its whitespace and paste it straight into a storage path such as storage/generation/<hash>.tar.gz. A hash carrying ../ segments climbs out of the storage directory, so the server returns a file from elsewhere on disk. Each handler appends the .tar.gz or .zip suffix itself, which holds a caller to those two extensions.
03Who is affected
Anyone self-hosting CoAI 4.0.0 or earlier is exposed on the four routes listed below. The reach covers .tar.gz and .zip files the CoAI process can read, which includes the generated project and article archives belonging to other users; the researcher reports that files with other extensions, such as configuration files, cannot be pulled this way.
04What to do
Put authentication in front of the generation and article download routes at a reverse proxy, or block them from untrusted networks, until a fixed release ships. Treat every archive the CoAI process can reach as readable by an unauthenticated caller.
Sources 4 links, all fetched
- 1vulncheck.comVulnCheck Advisory
- 2hackmd.ioResearcher Write-Up
- 3github.comGeneration Route
- 4github.comArticle Route