TI-2026-20244 Aliases CVE-2026-25060 GHSA-wf93-3ghh-h389

OpenList Insecure TLS Default Configuration

LOW 37CWE-599Published 2026-02-02 · Updated 2026-02-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, certificate verification is disabled by default for all storage driver communications. The TlsInsecureSkipVerify setting is default to true in the DefaultConfig() function in internal/conf/config.go. This vulnerability enables Man-in-the-Middle (MitM) attacks by disabling TLS certificate verification, allowing attackers to intercept and manipulate all storage communications. Attackers can exploit this through network-level attacks like ARP spoofing, rogue Wi-Fi access points, or compromised internal network equipment to redirect traffic to malicious endpoints. Since certificate validation is skipped, the system will unknowingly establish encrypted connections with attacker-controlled servers, enabling full decryption, data theft, and manipulation of all storage operations without triggering any security warnings. This vulnerability is fixed in 4.1.10.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0025 16th percentileScored 2026-11-07

Fix Fixed OpenList (OpenListTeam): 4.1.10github.com/OpenListTeam/OpenList/v4 (Go): 4.1.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OpenListTeam	OpenList	before 4.1.10	4.1.10	Patch available	CNA
—	github.com/OpenListTeam/OpenList/v4 (Go)	before 4.1.10	4.1.10	Patch available	GHSA-wf93-3ghh-h389

OpenList VendorOpenListTeam Affected before 4.1.10 Fixed in 4.1.10 Patch available CNA
github.com/OpenListTeam/OpenList/v4 (Go) Vendor— Affected before 4.1.10 Fixed in 4.1.10 Patch available GHSA-wf93-3ghh-h389

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:oplist:openlist::::::::	before 4.1.10	Vulnerable	Oplist

cpe:2.3:a:oplist:openlist:*:*:*:*:*:*:*:* Versions before 4.1.10 Vulnerable ·Oplist

Remediation

Fix · CNA OpenList (OpenListTeam) Fixed in 4.1.10
Fix · GHSA-wf93-3ghh-h389 github.com/OpenListTeam/OpenList/v4 (Go) Fixed in 4.1.10 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-25060
2026-10-03 Alias added: GHSA-wf93-3ghh-h389

References

Patch 1

https://github.com/OpenListTeam/OpenList/commit/e3c664f81d0584fbbdb86ffe6644be16259371c1

Advisory 2

Other 3

TI-2026-51619 OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal CVSS 3.1HIGH 7.6
TI-2026-52909 OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool CVSS 3.1MEDIUM 6.5
TI-2026-48534 OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API CVSS 3.1MEDIUM 6.5
TI-2025-32066 OpenList (frontend) allows XSS Attacks in the built-in Markdown Viewer CVSS 3.1MEDIUM 6.5
TI-2026-71250 Path prefix check flaw in OpenList search leaks file metadata CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences