EUVD-2026-70550
GHSA-h6cj-26g5-67fv
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
PR:L because non-admin users with PermAddOfflineDownload can exploit; C:N as the primitive writes but does not read files.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/add_offline_download with tool: "SimpleHttp" accepts an attacker-supplied URL and saves its bytes under a per-task temporary directory before transferring them to the user's destination storage. The temporary filename comes from the attacker-controlled Content-Disposition header, is passed from parseFilenameFromContentDisposition in internal/offline_download/http/util.go to filepath.Join(task.TempDir, filename) in SimpleHttp.Run in internal/offline_download/http/client.go, and is opened with os.Create without a containment check. Because filepath.Join cleans .. segments, a non-admin user with PermAddOfflineDownload on any path can traverse out of task.TempDir and create, truncate, or overwrite any file writable by the OpenList process whose parent directory already exists. The server/handles/offline_download.go AddOfflineDownload route uses normal user authentication rather than AuthAdmin, and local-storage destinations fall through tryPutUrl in internal/offline_download/tool/add.go to the vulnerable SimpleHttp.Run path. This issue is fixed in version 4.2.3.
AnalysisAI
Path traversal in OpenList prior to v4.2.3 allows any authenticated user holding the PermAddOfflineDownload permission to write, truncate, or overwrite arbitrary files accessible to the OpenList process via the SimpleHttp offline-download tool. The attacker controls a remote HTTP server that returns a crafted Content-Disposition header containing path-traversal sequences; OpenList uses the attacker-supplied filename without containment validation to construct a file path via filepath.Join relative to a per-task temporary directory, allowing traversal outside that directory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a valid OpenList account that has been granted the PermAddOfflineDownload permission on at least one storage path; administrator-level credentials (AuthAdmin) are explicitly not required. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS vector assigns PR:H (score 6.5), but the description explicitly states that any non-admin user granted PermAddOfflineDownload can exploit this path-the route uses 'normal user authentication rather than AuthAdmin'-placing this firmly in PR:L territory and raising the realistic score closer to 8.1. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to OpenList v4.2.3, which introduces the sanitizeFilename() helper using filepath.IsLocal() validation and adds an explicit path-containment prefix check before any file creation in SimpleHttp.Run; the fix commit is at https://github.com/OpenListTeam/OpenList/commit/9cc5dd969b9833c8cb4e14c338c3571dfdbe2108. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
OpenList Frontend versions prior to 4.1.10 contain a path traversal vulnerability in file operation handlers that allows
OpenList versions prior to 4.1.10 disable TLS certificate verification by default in storage driver communications, enab
Authenticated path traversal in OpenList's batch rename API allows any user with rename permission to move files outside
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today