Is CVE-2026-110766 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-110766?

CVE-2026-110766 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-110766

Description

Colanode server through 0.4.7 contains a path traversal vulnerability that allows authenticated users to read arbitrary .jpeg files by supplying an encoded traversal sequence in avatarId. Attackers can send percent-encoded ../ sequences to GET /client/v1/avatars/:avatarId to escape the avatars directory and read .jpeg files belonging to other workspaces.