CoAI (Chat Nio) through 4.0.0 contains an unauthenticated path traversal vulnerability in the generation and article archive download endpoints via the hash query parameter. Attackers can supply ../ sequences in hash to download any readable .tar.gz or .zip file, including other users' generated archives.
Get the CyboWatch SIEM platform, hosting, and 24×7 SOC analysts. Send an enquiry, or call or email us to get started.