CVE-2026-7680 | jsbroks COCO Annotator up to 0.11.1 Data Endpoint datasets.py folder path traversal

A vulnerability labeled as critical has been found in jsbroks COCO Annotator up to 0.11.1. Affected is an unknown function of the file backend/webserver/api/datasets.py of the component Data Endpoint. Executing a manipulation of the argument folder can lead to path traversal.

This vulnerability is tracked as CVE-2026-7680. The attack can be launched remotely. Moreover, an exploit is present.

The vendor was contacted early about this disclosure but did not respond in any way.