Read the docs
TI-2026-48534 Aliases CVE-2026-69160GHSA-86cx-wwf4-phq4

OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API

Priority MEDIUM 62CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.

Summary

OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefix(requested_path, user.BasePath) without enforcing a directory separator boundary. An authenticated user with CanShare permission and a BasePath such as /base can submit a sibling path such as /base2/secret.txt, create a share for the out-of-scope file, and use the public share download or list handlers to read data outside the assigned directory. This issue is fixed in version 4.2.4.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00402 34th percentileScored 2026-11-07
Fix Fixed OpenList (OpenListTeam): 4.2.4github.com/OpenListTeam/OpenList/v4 (Go): 4.2.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenListTeamOpenListbefore 4.2.44.2.4Patch availableCNA
—github.com/OpenListTeam/OpenList/v4 (Go)before 4.2.44.2.4Patch availableGHSA-86cx-wwf4-phq4
  • OpenList VendorOpenListTeam Affected before 4.2.4 Fixed in 4.2.4 Patch available CNA
  • github.com/OpenListTeam/OpenList/v4 (Go) Vendor— Affected before 4.2.4 Fixed in 4.2.4 Patch available GHSA-86cx-wwf4-phq4

Remediation

  • Fix · CNA OpenList (OpenListTeam) Fixed in 4.2.4
  • Fix · GHSA-86cx-wwf4-phq4 github.com/OpenListTeam/OpenList/v4 (Go) Fixed in 4.2.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-69160
  2. 2026-10-03 Alias added: GHSA-86cx-wwf4-phq4

References

Other 4

  • TI-2026-51619 OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal CVSS 3.1HIGH 7.6
  • TI-2026-52909 OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool CVSS 3.1MEDIUM 6.5
  • TI-2025-32066 OpenList (frontend) allows XSS Attacks in the built-in Markdown Viewer CVSS 3.1MEDIUM 6.5
  • TI-2026-71250 Path prefix check flaw in OpenList search leaks file metadata CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences