CVE-2026-69110

Name of the Vulnerable Software and Affected Versions OpenCode Studio versions prior to 2.4.4

Description Missing authentication allows remote attackers to read arbitrary files within the temp and static/music directories. This is achieved by accessing the 'GET /api/tmp/:tmpFile' and 'GET /api/music/:fileName' endpoints, enabling the retrieval of intermediate audio, video artifacts, and subtitles from other users. Additionally, attackers can delete videos by ID using the 'DELETE /api/short-video/:videoId' endpoint. The vulnerable variables include tmpFile, fileName, and videoId.

Recommendations Update to version 2.4.4 or later. Restrict access to the 'GET /api/tmp/:tmpFile', 'GET /api/music/:fileName', and 'DELETE /api/short-video/:videoId' endpoints as a temporary mitigation.