CVE-2026-69110
Received Received - Intake

Unauthenticated File Read in OpenCode Studio

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: VulnCheck

Description
OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the temp and static/music directories by directly accessing the GET /api/tmp/:tmpFile and GET /api/music/:fileName endpoints. Attackers can retrieve intermediate audio, video artifacts, and subtitles belonging to other users' jobs, and additionally delete any video by ID through the unauthenticated DELETE /api/short-video/:videoId endpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-69110
EUVD
EUVD-2026-52743

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
microck opencode_studio to 2.4.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unauthenticated file read and deletion issue in OpenCode Studio versions before 2.4.4. It allows remote attackers to read arbitrary files in the temp and static/music directories by accessing specific endpoints without authentication. Attackers can retrieve sensitive user data like audio, video artifacts, and subtitles from other users' jobs. Additionally, it enables unauthenticated deletion of videos via another endpoint.

Detection Guidance

Check if your OpenCode Studio version is below 2.4.4 by running: curl -s http://localhost:3000/version. If unauthenticated access to /api/tmp/:tmpFile, /api/music/:fileName, or DELETE /api/short-video/:videoId returns files or deletes content, the system is vulnerable.

Impact Analysis

If you use OpenCode Studio before version 2.4.4, attackers could access your temporary files, music files, or other sensitive data without authentication. They could also delete your videos or other content. This could lead to data breaches, loss of intellectual property, or disruption of services.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive user data. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information. A breach could result in legal penalties, fines, and reputational damage.

Mitigation Strategies

Upgrade OpenCode Studio to version 2.4.4 or later. Ensure the server is bound to 127.0.0.1 to restrict external access. Add authentication middleware to sensitive endpoints like /api/tmp, /api/music, and /api/short-video.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-69110. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart