Summary
OpenCode Studio versions before 2.4.4 expose file and video-management endpoints without authentication or authorization checks. An unauthenticated remote attacker may read temporary media and subtitle artifacts belonging to other users and delete videos by identifier.
Affected context
The issue occurs in OpenCode Studio deployments where the following endpoints are reachable by remote clients without an authenticated session or object-level authorization:
GET /api/tmp/:tmpFileGET /api/music/:fileNameDELETE /api/short-video/:videoId
Deployments using affected releases and storing user-generated intermediate artifacts in the exposed directories may disclose audio, video, or subtitle files across user boundaries.
Exploit preconditions
- Attack surface: Network-accessible OpenCode Studio HTTP API
- Required access: No authentication or prior account access is required
- Read trigger: A request to a temporary-file or music-file endpoint with a target file reference
- Delete trigger: A request to the video deletion endpoint with a target video identifier
- Why exploitation is possible: The endpoints do not adequately enforce authentication, authorization, or resource ownership before serving files or performing deletion
Why this happens
The underlying defect is an access-control failure at file-serving and resource-management endpoints. User-controlled file names or resource identifiers are accepted without reliably establishing the caller's identity and permission to access the selected object.
This behavior is associated with CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') because file-oriented endpoint input is not sufficiently constrained to an authorized resource scope. The missing authentication and object-level authorization controls allow requests to cross intended user or job boundaries.
Potential impact
- Sensitive intermediate audio, video, or subtitle artifacts may be disclosed
- Files belonging to other users or jobs could be accessed
- Video resources may be deleted without authorization
- Privacy, confidentiality, and content-integrity guarantees may be weakened
- Exposed media may support further targeting of users or processing workflows
General mitigation guidance
Mitigation generally focuses on enforcing authentication and resource-level authorization before every file or video operation.
Common defensive patterns include:
- Require authenticated sessions or service credentials for media and management endpoints
- Verify that the requester owns or is explicitly permitted to access the referenced job, file, or video
- Resolve file references against a controlled server-side mapping rather than accepting unrestricted path-like input
- Constrain file access to dedicated directories and reject normalized paths outside the intended scope
- Use opaque, non-guessable identifiers and avoid exposing shared temporary storage directly
- Apply least-privilege permissions to application and storage processes
- Require authorization checks and audit logging for destructive operations such as deletion
How teams detect issues like this
Detection can combine application testing, source review, and runtime monitoring.
Useful approaches include:
- Static analysis rules that identify unauthenticated routes serving files or mutating resources
- Code review checks for missing middleware, ownership checks, and path canonicalization
- Policy tests requiring authentication and authorization on every media-management route
- API tests that attempt cross-user file access and deletion using valid identifiers from another account
- Monitoring for repeated requests to temporary-file, music-file, and video-deletion endpoints without authenticated context
- Automated security review tools that flag direct filesystem access and identifier-based object operations without access checks
