Opencode Studio
Approved changes feed: RSS · Atom
cpe:2.3:a:microck:opencode-studio:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Microck (d4782722-c6b6-5aba-86de-237773039301) |
|---|---|
| Product | Opencode Studio (23f53bc2-ef6a-5024-8ed0-8fe362ce9b91) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-69110 |
vulnerable | 2026-09-16 04:34:20.331707 |
OpenCode Studio < 2.4.4 Unauthenticated File Read via /api/tmp and /api/music
CRITICAL (9.1)
OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the temp and static/music directories by directly accessing the GET /api/tmp/:tmpFile and GET /api/music/:fileName endpoints. Attackers can retrieve intermediate audio, video artifacts, and subtitles belonging to other users' jobs, and additionally delete any video by ID through the unauthenticated DELETE /api/short-video/:videoId endpoint.
Published: 2026-08-04T15:30:21.158Z
Updated: 2026-11-08T14:08:20.122Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.