CVE-2026-69160
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
OpenList, a file list program that supports multiple storage, prior to 4.2.4 contains a vulnerability where share creation and update checks use strings.HasPrefix(requested_path, user.BasePath) without enforcing a directory separator boundary. An authenticated user with CanShare permission and a BasePath such as /base can submit a sibling path such as /base2/secret.txt, create a share for the out-of-scope file, and use the public share download or list handlers to read data outside the assigned directory. This issue is fixed in version 4.2.4.
Risk Assessment
The risk includes unauthorized access to files outside the assigned directory, potentially leading to disclosure of sensitive data.
Recommendation
It is recommended to upgrade OpenList to version 4.2.4 or later and review existing shares for potential directory boundary violations.
Original NVD description (English source)
OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefix(requested_path, user.BasePath) without enforcing a directory separator boundary. An authenticated user with CanShare permission and a BasePath such as /base can submit a sibling path such as /base2/secret.txt, create a share for the out-of-scope file, and use the public share download or list handlers to read data outside the assigned directory. This issue is fixed in version 4.2.4.