Opensave
Monthly
OpenSave through 2.4.0 contains a path-validation bypass (CWE-73) in which a paired peer can supply save paths that fall outside the operator's configured save locations, enabling arbitrary file read and write on the target instance via the manifest request handler and sync routes. The CVSS 4.0 base score of 8.6 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H) reflects high confidentiality and integrity impact with no user interaction and low attack complexity, though the attacker must already be a paired peer of the target (authenticated, PR:L), so an unpaired remote party cannot reach the flaw. No public exploit code and no confirmed active exploitation were identified at time of analysis, but a public advisory and the affected source locations are documented, making the issue straightforward to reason about for anyone already inside a peer trust relationship.
Authentication bypass in Liquid-co OpenSave's WAN relay lets an unpaired room member impersonate a paired device and reach protected sync routes for save data, snapshots, and file operations. Any OpenSave instance running a version before 2.4.0-beta.1 with WAN relay sync enabled is affected; the attacker must already hold a valid 12-character room code, which is cryptographically generated and shared out-of-band, so exposure is realistically limited to people the room owner deliberately invited or whose code leaked, rather than the open internet. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is resolved by the vendor's 2.4.0-beta.1 release, which adds end-to-end encryption over the relay plus single-use per-request proof of the pairing key.
OpenSave through 2.4.0 contains a path-validation bypass (CWE-73) in which a paired peer can supply save paths that fall outside the operator's configured save locations, enabling arbitrary file read and write on the target instance via the manifest request handler and sync routes. The CVSS 4.0 base score of 8.6 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H) reflects high confidentiality and integrity impact with no user interaction and low attack complexity, though the attacker must already be a paired peer of the target (authenticated, PR:L), so an unpaired remote party cannot reach the flaw. No public exploit code and no confirmed active exploitation were identified at time of analysis, but a public advisory and the affected source locations are documented, making the issue straightforward to reason about for anyone already inside a peer trust relationship.
Authentication bypass in Liquid-co OpenSave's WAN relay lets an unpaired room member impersonate a paired device and reach protected sync routes for save data, snapshots, and file operations. Any OpenSave instance running a version before 2.4.0-beta.1 with WAN relay sync enabled is affected; the attacker must already hold a valid 12-character room code, which is cryptographically generated and shared out-of-band, so exposure is realistically limited to people the room owner deliberately invited or whose code leaked, rather than the open internet. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is resolved by the vendor's 2.4.0-beta.1 release, which adds end-to-end encryption over the relay plus single-use per-request proof of the pairing key.