Openlist
CVE-2026-25060
HIGH
GHSA-wf93-3ghh-h389
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessPosition on network path between client and storage
-
DeliveryIntercept TLS handshake
-
ExploitPresent attacker certificate
-
ExecutionClient accepts due to disabled verification
-
ImpactRead/modify storage communications
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V12 - Secure Communication Missing validation of OpenSSL certificate
|
| Exploitation Conditions | OpenList Frontend versions prior to 4.1.10 with default configuration where TlsInsecureSkipVerify is set to true in DefaultConfig() function. Requires network-level positioning (ARP spoofing, rogue access point, or compromised network equipment) to intercept storage driver communications. |
| Impact | CVSS 8.1 (HIGH). Attack vector: Network. Complexity: High. Privileges required: None. User interaction: None. Exploitable via remote/network. |
| Exploit ScenarioDerived | A remote attacker could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
OpenList versions prior to 4.1.10 disable TLS certificate verification by default in storage driver communications, enabling man-in-the-middle attacks where network-positioned attackers can intercept, decrypt, and manipulate all data exchanges with storage backends. This misconfiguration affects any deployment relying on OpenList Frontend's default settings and can be exploited via ARP spoofing, rogue access points, or compromised network infrastructure to redirect traffic to attacker-controlled servers. A patch is available in version 4.1.10 and later.
Earlier versions of this analysis (1)
OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, certificate verification is disabled by default for all storage driver communications. [CVSS 8.1 HIGH]
RemediationAI
A vendor patch is available — apply it immediately. Fixed in version 4.1.10.. Restrict network access to the affected service where possible.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Affects Openlist. OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, certificate verification is disabled by default for all storage driver communications. The TlsInsecureSkipVerify setting is default to true in the DefaultConfig() function in internal/conf/config.go. This vulnerability enables Man-in-the-Middle (MitM) attacks by disabling TLS certificate verification, allowing attackers to intercept and manipulate all storage communications. Attackers can exploit this through network-level attack
Know when Openlist gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, certificate verification is disabled by default for all storage driver communications. The TlsInsecureSkipVerify setting is default to true in the DefaultConfig() function in internal/conf/config.go. This vulnerability enables Man-in-the-Middle (MitM) attacks by disabling TLS certificate verification, allowing attackers to intercept and manipulate all storage communications. Attackers can exploit this through network-level attacks like ARP spoofing, rogue Wi-Fi access points, or compromised internal network equipment to redirect traffic to malicious endpoints. Since certificate validation is skipped, the system will unknowingly establish encrypted connections with attacker-controlled servers, enabling full decryption, data theft, and manipulation of all storage operations without triggering any security warnings. This vulnerability is fixed in 4.1.10.
Executive ViewAI
OpenList Frontend versions prior to 4.1.10 disable certificate verification by default, allowing attackers to intercept and manipulate storage communications without detection. Any organization using affected versions is exposed to data theft, data tampering, and potential lateral movement within infrastructure.
Apply vendor patch. If immediate patching is not possible: implement network segmentation to restrict storage driver communications to trusted networks only, enforce TLS 1.2+ at the network perimeter, and enable detailed logging of all storage driver connections for forensic analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Affected Products (CPE)GitHub Advisory
OpenList Frontend versions prior to 4.1.10 contain a path traversal vulnerability in file operation handlers that allows
Authenticated path traversal in OpenList's batch rename API allows any user with rename permission to move files outside
Path traversal in OpenList prior to v4.2.3 allows any authenticated user holding the PermAddOfflineDownload permission t
Metadata and file-existence disclosure in OpenList versions through 4.2.3 allows an authenticated low-privileged user wi
Exploit-DB