OpenSave EUVD-2026-89993

Exploitation requires the attacker to be a PAIRED PEER of the target OpenSave instance (PR:L) - the flaw is reached through the manifest request handler and sync routes that trust peer-supplied save paths. The concrete condition is that OpenSave through 2.4.0 fails to validate save paths against configured save locations (the rootguard check in internal/delta/rootguard.go is insufficient), allowing a peer to specify directories outside the intended save area for both read and write. Limiting factors: the attacker must first complete OpenSave's peer-pairing/trust handshake, so a fully unauthenticated/unpaired remote party cannot exploit it; no user interaction is needed once paired (UI:N), and no special non-default configuration is required beyond running an affected version and having an active peer.

The CVSS 4.0 base score of 8.6 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) reflects a genuinely serious flaw: a network-reachable path-validation bypass (CWE-73, external control of file name/path) that yields both arbitrary file READ (VC:H) and arbitrary file WRITE (VI:H) with no user interaction and low attack complexity. The key limiting signal is PR:L - exploitation requires the attacker to be a PAIRED PEER, so this is not a fully anonymous internet-wide attack but rather one gated by OpenSave's peering/trust model. No EPSS score, KEV listing, or explicit POC flag was supplied in the input; however, one reference is a GitHub gist (a common vehicle for proof-of-concept code) alongside a VulnCheck advisory and direct source-line citations (routes.go, rootguard.go), which together indicate the vulnerability is well-understood and likely reproducible. Weighing the signals: high technical impact (read+write) but constrained by peer authentication and a very small real-world deployment footprint means this is a real, high-severity bug for OpenSave users but not a mass-exploitation priority. Missing data to note explicitly: no EPSS/KEV to gauge exploitation likelihood, and POC status is inferred from the gist reference rather than a confirmed POC=YES flag - verify against the VulnCheck advisory.

An attacker establishes or compromises a paired-peer relationship with a victim OpenSave instance (v2.4.0 or earlier), then sends a manifest request specifying a save path with directory-traversal components pointing outside the configured save directory. Through the manifest and sync routes the attacker reads sensitive files (e.g., config, keys, documents) and writes attacker-controlled files to arbitrary locations, potentially overwriting binaries or configuration to escalate impact. A referenced GitHub gist appears to provide proof-of-concept material, lowering the barrier to reproduction.