Security readout for executives and security teams
Plain-English summary
OpenCode Studio versions before 2.4.4 expose API routes that can disclose other users’ temporary media, music, and subtitle files without authentication. A separate unauthenticated route can delete videos by ID. Internet-facing or otherwise untrusted-network-accessible deployments face confidentiality and integrity risks.
Executive priority
Treat as an immediate remediation priority for reachable deployments. Upgrade promptly, limit network exposure, and investigate possible disclosure or deletion. The lack of confirmed active exploitation lowers certainty about current compromise, not the underlying technical risk.
Technical view
Unauthenticated attackers can access GET /api/tmp/:tmpFile and GET /api/music/:fileName to read files within the temp and static/music directories. DELETE /api/short-video/:videoId also permits unauthorized video deletion. The CVSS 4.0 score is 9.3, reflecting remote, low-complexity, no-interaction exploitation with high confidentiality and integrity impact.
Likely exposure
Deployments running OpenCode Studio earlier than 2.4.4 are potentially exposed when affected API routes are reachable from untrusted networks. Likely affected data includes intermediate audio or video artifacts and subtitles from other users’ jobs. Exposure outside the named directories is not established by the bundle.
Exploitation context
The vulnerability and patch details are publicly available, increasing discovery and exploitation risk. However, the bundle marks this CVE as absent from KEV and provides no evidence of active exploitation in the wild.
Researcher notes
The description establishes directory-scoped arbitrary file access and unauthorized deletion, but not broader filesystem access or code execution. CWE-22 is assigned, while missing authentication is central to the described behavior. The affected-version metadata includes an anomalous “0”; validate exposure against the explicit before-2.4.4 statement and vendor release information.
Mitigation direction
- Upgrade OpenCode Studio to version 2.4.4 or later.
- Restrict affected API routes from untrusted networks until upgrading.
- Follow vendor guidance for authentication and authorization configuration.
- Review whether exposed media or subtitles contained sensitive information.
- Preserve and examine relevant access logs before routine retention removes them.
Validation and detection
- Inventory all OpenCode Studio deployments and confirm their installed versions.
- Verify affected GET routes reject unauthenticated requests after remediation.
- Verify the video deletion route requires appropriate authorization.
- Review logs for unexpected access to affected routes and unusual video deletions.
- Confirm temporary and music artifacts are not directly exposed through alternate routes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-22: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-69110 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N——VulnCheckCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N3.95.2VulnCheckVulnerability scoring details
Base CVSS 4.0 score
9.3CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- Researcher DisclosureCVE reference, VulnCheck · technical-description, exploit
- Release NotesCVE reference, VulnCheck · release-notes
- Pull RequestCVE reference, VulnCheck · issue-tracking
- Patch CommitCVE reference, VulnCheck · patch
- https://www.vulncheck.com/advisories/opencode-studio-unauthenticated-file-read-via-api-tmp-and-api-musicCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.