EUVD-2026-61101Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Requires authenticated account with CanShare permission (PR:L); path confusion is trivially exploited over the network with no interaction; impact is strictly read-only data access (C:H, I:N, A:N).
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
3DescriptionCVE.org
OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefix(requested_path, user.BasePath) without enforcing a directory separator boundary. An authenticated user with CanShare permission and a BasePath such as /base can submit a sibling path such as /base2/secret.txt, create a share for the out-of-scope file, and use the public share download or list handlers to read data outside the assigned directory. This issue is fixed in version 4.2.4.
AnalysisAI
Arbitrary file read in OpenList prior to 4.2.4 enables authenticated users with CanShare permission to bypass directory boundary enforcement and exfiltrate files outside their assigned BasePath. The flaw in the share creation and update handlers uses Go's strings.HasPrefix without a separator-aware boundary check, so a user restricted to /base can create a valid share for /base2/secret.txt because the prefix match returns true. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a valid OpenList account with the CanShare permission explicitly granted by an administrator - this is not a default permission for all users. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects the threat profile: exploitation requires a valid account with CanShare permission but is otherwise trivial - low attack complexity, no user interaction, no scope change, and high confidentiality impact with no integrity or availability effect. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade OpenList to version 4.2.4 immediately; this is the vendor-released patch confirmed in commit 59bd3431408578f420895457554700cc9a52375a and the v4.2.4 release at https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today