Read the docs
TI-2026-51619 Aliases CVE-2026-73509GHSA-95cv-r8x4-vh75

OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal

Priority HIGH 66CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

OpenList a file list program that supports multiple storage. Prior to 4.2.4, the authenticated /api/fs/batch_rename handler in server/handles/fsbatch.go authorizes only the source directory produced by user.JoinPath(req.SrcDir) and validates renameObject.NewName with checkRelativePath, but does not validate attacker-controlled renameObject.SrcName, supplied as src_name, before concatenating it with the authorized path and passing the result to fs.Rename. A user with rename permission can use traversal segments in src_name to make path normalization select a file outside the authorized directory and configured base path, resulting in cross-user file integrity loss, limited availability impact, and file-existence disclosure through success or error responses. This issue is fixed in version 4.2.4.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00522 44th percentileScored 2026-11-07
Fix Fixed OpenList (OpenListTeam): 4.2.4github.com/OpenListTeam/OpenList/v4 (Go): 4.2.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenListTeamOpenListbefore 4.2.44.2.4Patch availableCNA
—github.com/OpenListTeam/OpenList/v4 (Go)before 4.2.44.2.4Patch availableGHSA-95cv-r8x4-vh75
  • OpenList VendorOpenListTeam Affected before 4.2.4 Fixed in 4.2.4 Patch available CNA
  • github.com/OpenListTeam/OpenList/v4 (Go) Vendor— Affected before 4.2.4 Fixed in 4.2.4 Patch available GHSA-95cv-r8x4-vh75

Remediation

  • Fix · CNA OpenList (OpenListTeam) Fixed in 4.2.4
  • Fix · GHSA-95cv-r8x4-vh75 github.com/OpenListTeam/OpenList/v4 (Go) Fixed in 4.2.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-73509
  2. 2026-10-03 Alias added: GHSA-95cv-r8x4-vh75

References

Other 4

  • TI-2026-52909 OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool CVSS 3.1MEDIUM 6.5
  • TI-2026-48534 OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API CVSS 3.1MEDIUM 6.5
  • TI-2025-32066 OpenList (frontend) allows XSS Attacks in the built-in Markdown Viewer CVSS 3.1MEDIUM 6.5
  • TI-2026-71250 Path prefix check flaw in OpenList search leaks file metadata CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences