CVE-2026-7680: COCO Annotator path traversal

CISO Take

COCO Annotator, an open-source web tool used to label and manage image datasets for computer-vision model training, has an unpatched path traversal flaw in its dataset Data Endpoint: a low-privileged authenticated user can manipulate the 'folder' parameter to read files outside the intended dataset directory. The vendor was notified early and has not responded, so no fix is coming, and a public exploit write-up already documents the technique, meaning any team running an internet-facing instance is exposed today. Actual risk is tempered by a low EPSS score (0.47%, roughly top 61% of scored CVEs) and no CISA KEV listing or Nuclei template, so mass opportunistic scanning is unlikely, but the confidentiality-only impact (arbitrary file read) still threatens exposure of annotation-pipeline configs, credentials, or other projects' training data on the same host. Because there is no vendor patch, treat this as permanently unfixed upstream: restrict network access to trusted networks/VPN, run the service under a hardened, low-privilege OS account with filesystem restrictions (chroot/container with a minimal read-only mount), and monitor web server logs for '../' or encoded traversal sequences hitting the datasets API. If COCO Annotator is exposed to the internet anywhere in your ML data pipeline, prioritize taking it offline or isolating it until compensating controls are in place.

Sources:NVDEPSSATLASvuldb.com

What is the risk?

Medium overall severity (CVSS 4.3) driven by low complexity and no user interaction, but capped by the confidentiality-only impact (no integrity or availability loss) and the requirement for low-privileged authentication. Exploitability is meaningfully elevated by a public proof-of-concept and an unresponsive vendor guaranteeing no official patch, but real-world exploitation likelihood remains low per EPSS (0.47th percentile of all scored CVEs) and absence from CISA KEV. The realistic exposure window is long-lived: teams must self-remediate indefinitely since no fix will arrive upstream.

How does the attack unfold?

Initial Access

Adversary obtains or already holds a low-privileged authenticated account on a reachable COCO Annotator instance.

AML.T0049

Exploitation

Adversary sends a manipulated 'folder' parameter to the datasets Data Endpoint to traverse outside the intended directory.

AML.T0049

Data Access

Traversal returns contents of arbitrary readable files, including configs, credentials, or other annotation projects' data.

AML.T0037

Impact

Harvested credentials or exposed training data are used to pivot further or exfiltrate proprietary datasets.

AML.T0002.000

Initial Access

Adversary obtains or already holds a low-privileged authenticated account on a reachable COCO Annotator instance.

AML.T0049

Exploitation

Adversary sends a manipulated 'folder' parameter to the datasets Data Endpoint to traverse outside the intended directory.

AML.T0049

Data Access

Traversal returns contents of arbitrary readable files, including configs, credentials, or other annotation projects' data.

AML.T0037

Impact

Harvested credentials or exposed training data are used to pivot further or exfiltrate proprietary datasets.

AML.T0002.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
COCO Annotator	—	—	No patch

Do you use COCO Annotator? You're affected.

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 40% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CLow

INone

ANone

What should I do?

1 step

1) No vendor patch exists and none is expected (contacted, unresponsive) — do not wait for an upstream fix. 2) Restrict network exposure: place COCO Annotator behind a VPN or IP allowlist, never expose the Data Endpoint directly to the internet. 3) Run the backend under a dedicated, least-privilege OS user with a chrooted or containerized filesystem so traversal cannot reach files outside the intended dataset directory even if the parameter is abused. 4) Add input validation/WAF rules that reject '..' sequences, encoded traversal (%2e%2e), or absolute paths in the 'folder' parameter as a compensating control. 5) Audit and rotate any credentials or API keys stored on the same host/container as the application. 6) Monitor access logs for anomalous folder parameter values and repeated 4xx/path-traversal patterns on the datasets API.

How is it classified?

Data LeakageTraining DataAPIAML.T0002.000- Datasets AML.T0037- Data from Local System AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 10-Data and data governance

ISO 42001

A.10-Data for AI systems

NIST AI RMF

MANAGE-4-Risk monitoring and response for third-party/AI components

Frequently Asked Questions

What is CVE-2026-7680?

COCO Annotator, an open-source web tool used to label and manage image datasets for computer-vision model training, has an unpatched path traversal flaw in its dataset Data Endpoint: a low-privileged authenticated user can manipulate the 'folder' parameter to read files outside the intended dataset directory. The vendor was notified early and has not responded, so no fix is coming, and a public exploit write-up already documents the technique, meaning any team running an internet-facing instance is exposed today. Actual risk is tempered by a low EPSS score (0.47%, roughly top 61% of scored CVEs) and no CISA KEV listing or Nuclei template, so mass opportunistic scanning is unlikely, but the confidentiality-only impact (arbitrary file read) still threatens exposure of annotation-pipeline configs, credentials, or other projects' training data on the same host. Because there is no vendor patch, treat this as permanently unfixed upstream: restrict network access to trusted networks/VPN, run the service under a hardened, low-privilege OS account with filesystem restrictions (chroot/container with a minimal read-only mount), and monitor web server logs for '../' or encoded traversal sequences hitting the datasets API. If COCO Annotator is exposed to the internet anywhere in your ML data pipeline, prioritize taking it offline or isolating it until compensating controls are in place.

Is CVE-2026-7680 actively exploited?

No confirmed active exploitation of CVE-2026-7680 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-7680?

1) No vendor patch exists and none is expected (contacted, unresponsive) — do not wait for an upstream fix. 2) Restrict network exposure: place COCO Annotator behind a VPN or IP allowlist, never expose the Data Endpoint directly to the internet. 3) Run the backend under a dedicated, least-privilege OS user with a chrooted or containerized filesystem so traversal cannot reach files outside the intended dataset directory even if the parameter is abused. 4) Add input validation/WAF rules that reject '..' sequences, encoded traversal (%2e%2e), or absolute paths in the 'folder' parameter as a compensating control. 5) Audit and rotate any credentials or API keys stored on the same host/container as the application. 6) Monitor access logs for anomalous folder parameter values and repeated 4xx/path-traversal patterns on the datasets API.

What systems are affected by CVE-2026-7680?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, data annotation/labeling workflows.

What is the CVSS score for CVE-2026-7680?

CVE-2026-7680 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.47%.

What is the AI security impact?

Affected AI Architectures

training pipelinesdata annotation/labeling workflows

MITRE ATLAS Techniques

AML.T0002.000Datasets

AML.T0037Data from Local System

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 10

ISO 42001: A.10

NIST AI RMF: MANAGE-4

What are the technical details?

Original Advisory

A weakness has been identified in jsbroks COCO Annotator up to 0.11.1. Affected is an unknown function of the file backend/webserver/api/datasets.py of the component Data Endpoint. Executing a manipulation of the argument folder can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Exploitation Scenario

An adversary with a low-privileged COCO Annotator account (e.g., a contracted annotator or compromised low-tier credential) sends a crafted request to the datasets API's Data Endpoint, setting the 'folder' parameter to a traversal sequence such as '../../../../etc/passwd' or a path pointing at the application's config directory. Because the endpoint does not sanitize the parameter, the backend returns file contents from outside the intended dataset storage path. The adversary repeats this against likely paths for environment files, cloud storage credentials, or other tenants' annotation projects, harvesting secrets or proprietary training data without needing elevated privileges or user interaction.

Weaknesses (CWE)

CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.