Path prefix check flaw in OpenList search leaks file metadata
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure, Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200 and CWE-639.
Summary
OpenList before 4.2.4 is affected. The search API checks a restricted user's base path with a strings.HasPrefix comparison that ignores path separators, so a sibling path such as /base2 passes a check for /base (CWE-639). With Bleve search enabled, an authenticated user with restricted access can search the global index and learn file metadata or existence outside their path, and the backend total can reveal a match even when individual results are removed.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally indexed Bleve results against a restricted user's BasePath. When Bleve search is enabled and a restricted authenticated user searches the global index for content in a sibling path, the user causes a globally indexed sibling-path result to pass the prefix check. The strings.HasPrefix(node.Parent, user.BasePath) predicate allows a sibling path such as /base2 to be treated as contained by /base. Unauthorized file metadata or file-existence information can be disclosed, and the backend Total value can reveal a match even when another access check removes the individual result. This issue is fixed in version 4.2.4.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| OpenListTeam | OpenList | before 4.2.4 | 4.2.4 | Patch available | CNA |
- OpenList VendorOpenListTeam Affected before 4.2.4 Fixed in 4.2.4 Patch available CNA
Remediation
Update OpenList to version 4.2.4, which fixes this issue.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA OpenList (OpenListTeam) Fixed in 4.2.4
Timeline
- 2026-10-12 Threatist record created from CVE-2026-102663
- 2026-10-13 CISA SSVC decision points changed
- 2026-10-13 Priority changed: LOW → MEDIUM
References
Other 4
- https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-p6ph-3jx2-3337
- https://github.com/OpenListTeam/OpenList/commit/59bd3431408578f420895457554700cc9a52375a
- https://github.com/OpenListTeam/OpenList/commit/84ecda35aae2bd0020474086e6ddfd3aa2340679
- https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4
More OpenListTeam vulnerabilities
- TI-2026-51619 OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal CVSS 3.1HIGH 7.6
- TI-2026-52909 OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool CVSS 3.1MEDIUM 6.5
- TI-2026-48534 OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API CVSS 3.1MEDIUM 6.5
- TI-2025-32066 OpenList (frontend) allows XSS Attacks in the built-in Markdown Viewer CVSS 3.1MEDIUM 6.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences