CVE Intelligence

Colanode Colanode vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Colanode Colanode: 1 record(s), with affected versions and fixes.

CVE-2026-110766 Medium · 4.3 CWE-22 Oct 14, 2026
Colanode Server through 0.4.7 Path Traversal via Avatar Download Route
Colanode server through 0.4.7 contains a path traversal vulnerability that allows authenticated users to read arbitrary .jpeg files by supplying an encoded traversal sequence in avatarId. Attackers can send percent-encoded ../ sequences to GET /client/v1/avatars/:avatarId to escape the avatars directory and read .jpeg files belonging to other workspaces.