Openlist
CVE-2026-25059
HIGH
GHSA-qmj2-8r24-xxcq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to OpenList Frontend
-
DeliveryCraft request with '..' in filename components
-
ExploitBypass path validation in fsmanage.go
-
ExecutionAccess files outside authorized directory
-
ImpactDelete or modify other users' files
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Authenticated user account on OpenList Frontend; vulnerable versions prior to 4.1.10; multiple users sharing same storage mount; file operation handlers (fsmanage.go) must process req.Names parameter with path traversal sequences. |
| Impact | CVSS 8.8 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: Low. User interaction: None. Exploitation no authentication required. Public exploit/POC available. |
| Exploit ScenarioDerived | An attacker without authentication could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
OpenList Frontend versions prior to 4.1.10 contain a path traversal vulnerability in file operation handlers that allows authenticated users to bypass directory restrictions and access other users' files on the same storage mount. An attacker can exploit this by injecting ".." sequences into filename parameters to perform unauthorized file operations including deletion, renaming, and copying across user boundaries. Public exploit code exists for this vulnerability, which is resolved in version 4.1.10.
Earlier versions of this analysis (1)
OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, the application contains path traversal vulnerability in multiple file operation handlers in server/handles/fsmanage.go. [CVSS 8.8 HIGH]
RemediationAI
A vendor patch is available — apply it immediately. Fixed in version 4.1.10.. Validate and sanitize file path inputs. Use allowlists. Restrict network access to the affected service where possible.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-22 (Path Traversal). Affects the multiple file operation component of Openlist. OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, the application contains path traversal vulnerability in multiple file operation handlers in server/handles/fsmanage.go. Filename components in req.Names are directly concatenated with validated directories using stdpath.Join. This allows ".." sequences to bypass path restrictions, enabling users to access other users' files within the same storage mount and perform unauthorized actions such as deletion, renaming, or copying of f
Know when Openlist gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, the application contains path traversal vulnerability in multiple file operation handlers in server/handles/fsmanage.go. Filename components in req.Names are directly concatenated with validated directories using stdpath.Join. This allows ".." sequences to bypass path restrictions, enabling users to access other users' files within the same storage mount and perform unauthorized actions such as deletion, renaming, or copying of files. An authenticated attacker can bypass directory-level authorisation by injecting traversal sequences into filename components, enabling unauthorised file removal and copying across user boundaries within the same storage mount. This vulnerability is fixed in 4.1.10.
Executive ViewAI
OpenList Frontend versions prior to 4.1.10 contain a critical path traversal vulnerability that could allow attackers to access, modify, or delete files on affected systems. This impacts any organization using vulnerable versions of OpenList and requires immediate patching to prevent unauthorized data exposure or system compromise.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Affected Products (CPE)GitHub Advisory
Authenticated path traversal in OpenList's batch rename API allows any user with rename permission to move files outside
Path traversal in OpenList prior to v4.2.3 allows any authenticated user holding the PermAddOfflineDownload permission t
OpenList versions prior to 4.1.10 disable TLS certificate verification by default in storage driver communications, enab
Metadata and file-existence disclosure in OpenList versions through 4.2.3 allows an authenticated low-privileged user wi
Exploit-DB