PT-2026-36682 · Jsbroks · Coco Annotator

Nmmorette · Published 2026-05-03 · Updated 2026-05-03 · CVE-2026-7680

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions jsbroks COCO Annotator versions prior to 0.11.2

Description A path traversal issue exists in the Data Endpoint component within the file backend/webserver/api/datasets.py. A remote attacker can manipulate the folder argument to access files and directories outside the intended folder. Path traversal is a technique that allows an attacker to read or write files on the server by using special characters like "../" to navigate the file system.

Recommendations Update jsbroks COCO Annotator to a version newer than 0.11.1. As a temporary workaround, restrict access to the Data Endpoint or avoid using the folder argument in the affected API endpoint until a patch is applied.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-7680

Affected Products

Coco Annotator

References · 8

• 🔥 https://github.com/natanmorette-thoropass/thoropass-vuln-research-program/tree/main/2026/Path%20Traversal%20via%20Dataset%20Folder%20Parameter · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7680 · Security Note
• https://vuldb.com/vuln/360833 · Note
• https://vuldb.com/submit/801150 · Note
• https://twitter.com/VulmonFeeds/status/2050830027692888565 · Twitter Post
• https://t.me/CVEtracker/52559 · Telegram Post
• https://vuldb.com/vuln/360833/cti · Note
• https://t.me/cveNotify/161911 · Telegram Post