CVE-2026-7680: COCO Annotator — Path Traversal via Dataset Folder Parameter

Sun, 03 May 2026 00:00:00 -0300

⚠ Replicated advisory. This post reproduces an advisory originally researched and published under the Thoropass Vulnerability Research Program. It is republished here for reference. The original disclosure followed coordinated vulnerability disclosure and the rules of the CVE Program.

🔗 Original advisory: https://github.com/heylaika/vuln-research-program/tree/main/2026/CVE-2026-7680%20-%20COCO%20Annotator%20-%20Path%20Traversal%20via%20Dataset%20Folder%20Parameter
📋 CVE record: CVE-2026-7680

Advisory Information


Researcher	Natan Morette on behalf of Thoropass
Product	COCO Annotator - Open-source, web-based image annotation platform used to build datasets for computer vision and machine learning workflows, supporting the COCO dataset format.
Affected Version	v0.11.1 and all prior versions
Endpoint	`backend/webserver/api/datasets.py` — `DatasetDataId` endpoint
Vulnerability Type	CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)
CVE ID	CVE-2026-7680

Vulnerability Summary

A path traversal vulnerability exists in the COCO Annotator dataset browsing API. The GET /api/dataset/<id>/data endpoint accepts a folder query parameter that is concatenated into a filesystem path without proper sanitization or containment validation.

Path Traversal on Natan Maia Morette

CVE-2026-7680: COCO Annotator — Path Traversal via Dataset Folder Parameter

Advisory Information

Vulnerability Summary