CVE-2026-69110

CriticalCVSS 9.1

Published: 04/08/2026(UTC)Updated: 04/08/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

OpenCode Studio before version 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the temp and static/music directories by directly accessing the GET /api/tmp/:tmpFile and GET /api/music/:fileName endpoints. Attackers can also delete any video by ID through the unauthenticated DELETE /api/short-video/:videoId endpoint.

Risk Assessment

An unauthenticated attacker can access sensitive files of other users and delete resources, potentially leading to privacy breaches and data integrity issues.

Recommendation

Update OpenCode Studio to version 2.4.4 or later, which includes a fix for this vulnerability.

Original NVD description (English source)

OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the temp and static/music directories by directly accessing the GET /api/tmp/:tmpFile and GET /api/music/:fileName endpoints. Attackers can retrieve intermediate audio, video artifacts, and subtitles belonging to other users' jobs, and additionally delete any video by ID through the unauthenticated DELETE /api/short-video/:videoId endpoint.