CVE-2026-7680

MediumCVSS 4.3

Published: 03/05/2026(UTC)Updated: 26/10/2026(UTC)Translated: 03/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.47%

40th percentile - higher than 40% of all known CVEs

Summary

A path traversal vulnerability was found in COCO Annotator up to version 0.11.1. The issue affects an unknown function in the file backend/webserver/api/datasets.py of the Data Endpoint component. Manipulating the folder argument allows a remote attack.

Risk Assessment

An attacker can remotely access files outside the intended directory, potentially leading to disclosure of sensitive data or compromise of system integrity.

Recommendation

Update COCO Annotator to the latest available version if one exists. Otherwise, restrict access to the application and monitor logs for suspicious requests.

Other vulnerabilities in COCO Annotator

CVE-2026-7681Medium
A security vulnerability was detected in jsbroks COCO Annotator up to 0.11.1 affecting the Dataset API component (backend/webserver/api/datasets.py). Manipulation of the DatasetId argument leads to authorization bypass, and the attack may be initiated remotely. The exploit has been publicly disclosed and the vendor did not respond.

Original NVD description (English source)

A weakness has been identified in jsbroks COCO Annotator up to 0.11.1. Affected is an unknown function of the file backend/webserver/api/datasets.py of the component Data Endpoint. Executing a manipulation of the argument folder can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS