The vulnerability allows an attacker to read arbitrary JPEG files on the server by exploiting path traversal in the avatarId parameter. By sending percent‑encoded "/../" sequences to the endpoint /client/v1/avatars/:avatarId, authenticated users can escape the intended avatars directory and access other .jpeg files stored on the filesystem. This leads to unintended exposure of content that may contain sensitive workspace data, but does not enable code execution or broader system compromise.

Colanode Server versions up to 0.4.7 are affected. The product is the Colanode server component maintained by the colanode vendor. No specific patch or updated version is listed in the provided data.

The CVSS score of 5.3 categorizes the risk as moderate. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires legitimate authentication; however, any user with valid credentials can trigger the exploit by crafting a suitable avatarId in a GET request. The threat is constrained to information disclosure, but attackers could combine it with other vulnerabilities to increase impact.