CyberRota Analysis
AI-GeneratedOpenCode Studio versions prior to 2.4.4 are vulnerable to a critical missing authentication flaw that enables unauthenticated remote attackers to access and read arbitrary files in the temp and static/music directories, as well as delete videos by ID. This vulnerability poses a significant risk as it allows attackers to exploit sensitive user data, including audio, video artifacts, and subtitles. Organizations using OpenCode Studio should prioritize patching to mitigate potential data breaches and unauthorized content manipulation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the temp and static/music directories by directly accessing the GET /api/tmp/:tmpFile and GET /api/music/:fileName endpoints. Attackers can retrieve intermediate audio, video artifacts, and subtitles belonging to other users' jobs, and additionally delete any video by ID through the unauthenticated DELETE /api/short-video/:videoId endpoint.