Openlist
Monthly
Path traversal in OpenList prior to v4.2.3 allows any authenticated user holding the PermAddOfflineDownload permission to write, truncate, or overwrite arbitrary files accessible to the OpenList process via the SimpleHttp offline-download tool. The attacker controls a remote HTTP server that returns a crafted Content-Disposition header containing path-traversal sequences; OpenList uses the attacker-supplied filename without containment validation to construct a file path via filepath.Join relative to a per-task temporary directory, allowing traversal outside that directory. No public exploit has been identified at time of analysis, though the GHSA advisory details the exact vulnerable function and the fix commit is publicly accessible, significantly lowering the effort required to develop one.
Authenticated path traversal in OpenList's batch rename API allows any user with rename permission to move files outside their authorized storage boundary. The `/api/fs/batch_rename` endpoint in `server/handles/fsbatch.go` validates `src_dir` and `new_name` against path traversal, but leaves `src_name` unchecked before concatenating it with the authorized path and passing the result to `fs.Rename`. A detailed proof-of-concept is embedded in the GHSA advisory; no CISA KEV listing exists, but the low privilege bar (any authenticated user with rename permission) makes cross-user file integrity loss and file-existence disclosure realistically exploitable in multi-tenant deployments. The issue is fixed in version 4.2.4.
OpenList versions prior to 4.1.10 disable TLS certificate verification by default in storage driver communications, enabling man-in-the-middle attacks where network-positioned attackers can intercept, decrypt, and manipulate all data exchanges with storage backends. This misconfiguration affects any deployment relying on OpenList Frontend's default settings and can be exploited via ARP spoofing, rogue access points, or compromised network infrastructure to redirect traffic to attacker-controlled servers. A patch is available in version 4.1.10 and later.
OpenList Frontend versions prior to 4.1.10 contain a path traversal vulnerability in file operation handlers that allows authenticated users to bypass directory restrictions and access other users' files on the same storage mount. An attacker can exploit this by injecting ".." sequences into filename parameters to perform unauthorized file operations including deletion, renaming, and copying across user boundaries. Public exploit code exists for this vulnerability, which is resolved in version 4.1.10.
Path traversal in OpenList prior to v4.2.3 allows any authenticated user holding the PermAddOfflineDownload permission to write, truncate, or overwrite arbitrary files accessible to the OpenList process via the SimpleHttp offline-download tool. The attacker controls a remote HTTP server that returns a crafted Content-Disposition header containing path-traversal sequences; OpenList uses the attacker-supplied filename without containment validation to construct a file path via filepath.Join relative to a per-task temporary directory, allowing traversal outside that directory. No public exploit has been identified at time of analysis, though the GHSA advisory details the exact vulnerable function and the fix commit is publicly accessible, significantly lowering the effort required to develop one.
Authenticated path traversal in OpenList's batch rename API allows any user with rename permission to move files outside their authorized storage boundary. The `/api/fs/batch_rename` endpoint in `server/handles/fsbatch.go` validates `src_dir` and `new_name` against path traversal, but leaves `src_name` unchecked before concatenating it with the authorized path and passing the result to `fs.Rename`. A detailed proof-of-concept is embedded in the GHSA advisory; no CISA KEV listing exists, but the low privilege bar (any authenticated user with rename permission) makes cross-user file integrity loss and file-existence disclosure realistically exploitable in multi-tenant deployments. The issue is fixed in version 4.2.4.
OpenList versions prior to 4.1.10 disable TLS certificate verification by default in storage driver communications, enabling man-in-the-middle attacks where network-positioned attackers can intercept, decrypt, and manipulate all data exchanges with storage backends. This misconfiguration affects any deployment relying on OpenList Frontend's default settings and can be exploited via ARP spoofing, rogue access points, or compromised network infrastructure to redirect traffic to attacker-controlled servers. A patch is available in version 4.1.10 and later.
OpenList Frontend versions prior to 4.1.10 contain a path traversal vulnerability in file operation handlers that allows authenticated users to bypass directory restrictions and access other users' files on the same storage mount. An attacker can exploit this by injecting ".." sequences into filename parameters to perform unauthorized file operations including deletion, renaming, and copying across user boundaries. Public exploit code exists for this vulnerability, which is resolved in version 4.1.10.