{"vulnerability": "GHSA-95cv-r8x4-vh75", "sightings": [{"uuid": "26a8662d-4fe3-4f15-9572-1f7e764830dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-95cv-r8x4-vh75", "type": "seen", "source": "https://gist.github.com/alon710/729285587ead72551cfda5647c8e9398", "content": "# GHSA-95CV-R8X4-VH75: GHSA-95cv-r8x4-vh75: Path Traversal Vulnerability in OpenList Batch Rename Handler\n\n> **CVSS Score:** 7.6\n> **Published:** 2026-07-24\n> **Full Report:** https://cvereports.com/reports/GHSA-95CV-R8X4-VH75\n\n## Summary\nA critical path traversal vulnerability has been identified in the OpenList Go-based backend package. The vulnerability exists within the batch rename handler because the application does not validate the source filename parameter before constructing filesystems paths. This omission allows authenticated users to escape their designated directory and rename files in sibling paths.\n\n## TL;DR\nAuthenticated users can rename files outside their base path via path traversal sequences in the batch rename 'src_name' parameter.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network\n- **CVSS v3.1**: 7.6 (High)\n- **Exploit Status**: Proof of Concept\n- **CISA KEV Status**: Not Listed\n- **Impact**: Integrity & Availability Violations\n\n## Affected Systems\n\n- OpenList Backend v4.2.3 and below\n- **OpenList**: <= v4.2.3 (Fixed in: `v4.2.4`)\n\n## Mitigation\n\n- Upgrade the package to v4.2.4 or later.\n- Implement a Web Application Firewall rule to inspect and block payload containing directory traversal sequences.\n- Ensure the application process runs with the minimum required OS-level filesystem privileges.\n\n**Remediation Steps:**\n1. Update the Go module using 'go get github.com/OpenListTeam/OpenList/v4@v4.2.4'.\n2. Run 'go mod tidy' to update the dependency tree.\n3. Rebuild and redeploy the backend server.\n4. Verify the fix by attempting a batch rename operation with a '..' sequence.\n\n## References\n\n- [GitHub Advisory Database Entry](https://github.com/advisories/GHSA-95cv-r8x4-vh75)\n- [OpenList Security Advisory](https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-95cv-r8x4-vh75)\n- [OpenList v4.2.4 Release](https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-95CV-R8X4-VH75) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-25T17:31:12.599343Z"}]}