OpenCode Studio up to version 2.4.3 allows attackers to read any file under the temp and music directories and delete videos via a public API. The missing authentication checks enable remote users to retrieve job artifacts—including audio, video fragments, and subtitles—and to destroy media files. This vulnerability is categorized as CWE‑22, an improper handling of file paths that results in unrestricted access to the file system, thereby compromising confidentiality and integrity of user content and the availability of media resources.

The affected product is OpenCode Studio from Microck. All versions earlier than the 2.4.4 release are vulnerable. Instances exposing the /api/tmp/:tmpFile, /api/music/:fileName, or /api/short-video/:videoId endpoints are susceptible. Administrators should verify if their deployment runs a legacy version and whether these endpoints are reachable from the internet.

The issue carries a CVSS score of 9.3, classifying it as critical. Attackers need only standard internet connectivity and can issue unauthenticated GET or DELETE requests over HTTP/HTTPS, indicating a high likelihood of exploitation. No EPSS score is available, but the public API nature of the flaw and lack of authentication raise concern. The vulnerability is not listed in CISA KEV, yet its impact justifies immediate attention.