CVE-2026-110766

The Colanode server (version 0.4.7 and earlier ) is vulnerable to a path traversal vulnerability (CWE-22) in the Avatar Download Route . Authenticated users can read arbitrary .jpeg files by providing a percent-encoded ../ traversal sequence in the avatarId parameter. By sending a GET request to ...