FKIE_CVE-2026-25059

Vulnerability from fkie_nvd - Published: 2026-02-02 23:16 - Updated: 2026-02-23 17:35
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, the application contains path traversal vulnerability in multiple file operation handlers in server/handles/fsmanage.go. Filename components in req.Names are directly concatenated with validated directories using stdpath.Join. This allows ".." sequences to bypass path restrictions, enabling users to access other users' files within the same storage mount and perform unauthorized actions such as deletion, renaming, or copying of files. An authenticated attacker can bypass directory-level authorisation by injecting traversal sequences into filename components, enabling unauthorised file removal and copying across user boundaries within the same storage mount. This vulnerability is fixed in 4.1.10.
References
security-advisories@github.comhttps://github.com/OpenListTeam/OpenList/commit/7b78fed106382430c69ef351d43f5d09928fff14Patch
security-advisories@github.comhttps://github.com/OpenListTeam/OpenList/releases/tag/v4.1.10Release Notes
security-advisories@github.comhttps://github.com/OpenListTeam/OpenList/security/advisories/GHSA-qmj2-8r24-xxcqExploit, Vendor Advisory
Impacted products
Vendor Product Version
oplist openlist *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oplist:openlist:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8A540671-DE84-45FD-A087-21A565765CF4",
              "versionEndExcluding": "4.1.10",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, the application contains path traversal vulnerability in multiple file operation handlers in server/handles/fsmanage.go. Filename components in req.Names are directly concatenated with validated directories using stdpath.Join. This allows \"..\" sequences to bypass path restrictions, enabling users to access other users\u0027 files within the same storage mount and perform unauthorized actions such as deletion, renaming, or copying of files. An authenticated attacker can bypass directory-level authorisation by injecting traversal sequences into filename components, enabling unauthorised file removal and copying across user boundaries within the same storage mount. This vulnerability is fixed in 4.1.10."
    },
    {
      "lang": "es",
      "value": "OpenList Frontend es un componente de UI para OpenList. Antes de la 4.1.10, la aplicaci\u00f3n contiene una vulnerabilidad de salto de ruta en m\u00faltiples manejadores de operaciones de archivo en server/handles/fsmanage.go. Los componentes de nombre de archivo en req.Names se concatenan directamente con directorios validados usando stdpath.Join. Esto permite que las secuencias \u0027..\u0027 evadan las restricciones de ruta, permitiendo a los usuarios acceder a los archivos de otros usuarios dentro del mismo montaje de almacenamiento y realizar acciones no autorizadas como la eliminaci\u00f3n, el cambio de nombre o la copia de archivos. Un atacante autenticado puede evadir la autorizaci\u00f3n a nivel de directorio inyectando secuencias de salto de ruta en los componentes de nombre de archivo, permitiendo la eliminaci\u00f3n y copia de archivos no autorizadas entre l\u00edmites de usuario dentro del mismo montaje de almacenamiento. Esta vulnerabilidad est\u00e1 corregida en la 4.1.10."
    }
  ],
  "id": "CVE-2026-25059",
  "lastModified": "2026-02-23T17:35:20.183",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-02-02T23:16:08.753",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/OpenListTeam/OpenList/commit/7b78fed106382430c69ef351d43f5d09928fff14"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/OpenListTeam/OpenList/releases/tag/v4.1.10"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-qmj2-8r24-xxcq"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.