A path‑traversal weakness exists in jsbroks COCO Annotator up to 0.11.1. The vulnerable code in backend/webserver/api/datasets.py allows an attacker to manipulate the folder argument and read files outside the intended data directory. This can expose configuration files, credentials, or code and thus compromise confidentiality. In the supplied description the exploit is available to the public and can be launched remotely, though no authentication prerequisites are listed.

jsbroks COCO Annotator versions 0.11.1 and older are affected. The vulnerability resides in the Data Endpoint implementation behind the datasets API; no other products or earlier releases are listed.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not reported. The vulnerability is not listed in CISA’s KEV catalog. Because the flaw can be triggered remotely via a crafted HTTP request to the Data Endpoint and the exploit has already been made publicly available, the risk of exploitation is non‑negligible. An attacker could obtain arbitrary file contents, potentially leading to a broader compromise if sensitive files are accessed.