6 matches found
CVE-2026-69110
OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the temp and static/music directories by directly accessing the GET /api/tmp/:tmpFile and GET /api/music/:fileName endpoints. Attackers can...
CVE-2026-69110 OpenCode Studio < 2.4.4 Unauthenticated File Read via /api/tmp and /api/music
OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the temp and static/music directories by directly accessing the GET /api/tmp/:tmpFile and GET /api/music/:fileName endpoints. Attackers can...
EUVD-2026-52743
OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the temp and static/music directories by directly accessing the GET /api/tmp/:tmpFile and GET /api/music/:fileName endpoints. Attackers can...
@extropolis/claudia (>=0.2.1, <=0.2.29) potentially affected by CVE-2026-69110 via opencode-studio-server (1.28.3)
opencode-studio-server NPM version 1.28.3 is affected by a known vulnerability. The following packages have a transitive dependency on opencode-studio-server and may be impacted: - @extropolis/claudia =0.2.1, =0.2.29 Source cves: CVE-2026-69110 Source advisory: MEND:CVE-2026-69110...
PT-2026-67746
Name of the Vulnerable Software and Affected Versions OpenCode Studio versions prior to 2.4.4 Description Missing authentication allows remote attackers to read arbitrary files within the temp and static/music directories. This is achieved by accessing the 'GET /api/tmp/:tmpFile' and 'GET...
CVE-2026-69110: Improper Limitation of a Pathname to a Restricted Directory
OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the temp and static/music directories by directly accessing the GET /api/tmp/:tmpFile and GET /api/music/:fileName endpoints. Attackers can...