CoAI (Chat Nio) through 4.0.0 has an unauthenticated path traversal flaw in the generation and article archive download endpoints. The vulnerability is triggered by the hash query parameter, which can contain "../" sequences to escape the intended archive directory. When resolved, attackers can download any readable .tar.gz or .zip file from the server, including archives belonging to other users. This flaw enables the disclosure of other users’ archive contents, compromising confidentiality and potentially allowing an attacker to gather sensitive information about internal generation processes. The weakness is a classic path traversal bug.

The affected product is CoAI from Coaidev, Version 4.0.0. No other versions are reported as impacted by this specific issue.

The CVSS score of 6.9 indicates a moderate severity. The EPSS score is not available, so the current exploitation probability is unknown, but the flaw is unauthenticated and easily exploitable via simple HTTP requests. The vulnerability is not listed in CISA KEV, suggesting no public weaponized exploit is currently known. Attackers can use any browser or simple curl commands to construct the hash parameter with traversal sequences, making the attack straightforward if the endpoints are exposed.