https://vulnerability.circl.lu/sightings/feed 2026-07-28T17:21:55.526344+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/f6246b96-1b93-4a76-ae3c-623a5474f96c/export 2026-07-28T17:21:55.532926+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "f6246b96-1b93-4a76-ae3c-623a5474f96c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-86CX-WWF4-PHQ4", "type": "seen", "source": "https://gist.github.com/alon710/341e4798332dfd78cba00be899ecacf7", "content": "# GHSA-86CX-WWF4-PHQ4: GHSA-86cx-wwf4-phq4: Path Prefix Confusion Authorization Bypass in OpenList\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-07-24\n> **Full Report:** https://cvereports.com/reports/GHSA-86CX-WWF4-PHQ4\n\n## Summary\nAn authorization bypass vulnerability in OpenList version 4.2.3 and below allows authenticated users to read arbitrary files outside of their designated base directories due to an insecure path prefix check using Go's standard strings.HasPrefix function.\n\n## TL;DR\nOpenList version 4.2.3 and below is vulnerable to an authorization bypass where authenticated users can access sibling directories due to literal string prefix matching on user base paths.\n\n## Technical Details\n\n- **CWE ID**: CWE-639: Authorization Bypass Through User-Controlled Key\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 6.5 (Medium)\n- **EPSS Score**: Not Applicable\n- **Impact**: Arbitrary File Read / Authorization Bypass\n- **Exploit Status**: Proof of Concept (PoC) documented\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- OpenList <= 4.2.3\n- **OpenList**: <= 4.2.3 (Fixed in: `4.2.4`)\n\n## Mitigation\n\n- Upgrade OpenList to version 4.2.4 or later.\n- Append a trailing slash to all user BasePaths in the database configuration.\n- Temporarily revoke sharing privileges (CanShare) for untrusted accounts.\n\n**Remediation Steps:**\n1. Deploy OpenList version 4.2.4.\n2. Inspect the database for share records referencing files outside their owner's intended directory structure.\n3. Update user configurations to enforce slash-terminated base directories if running a legacy version.\n\n## References\n\n- [GitHub Security Advisory GHSA-86cx-wwf4-phq4](https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-86cx-wwf4-phq4)\n- [Official GitHub Advisory Database Link](https://github.com/advisories/GHSA-86cx-wwf4-phq4)\n- [Security Remediation Commit](https://github.com/OpenListTeam/OpenList/commit/59bd3431408578f420895457554700cc9a52375a)\n- [OpenList v4.2.4 Patch Release](https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-86CX-WWF4-PHQ4) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-25T15:32:47.096045Z"} 2026-07-25T15:32:47.096045+00:00