CVE-2026-69160
Received Received - Intake

OpenList Path Traversal Vulnerability Before 4.2.4

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefix(requested_path, user.BasePath) without enforcing a directory separator boundary. An authenticated user with CanShare permission and a BasePath such as /base can submit a sibling path such as /base2/secret.txt, create a share for the out-of-scope file, and use the public share download or list handlers to read data outside the assigned directory. This issue is fixed in version 4.2.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-69160
EUVD
EUVD-2026-61101

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openlist openlist 4.2.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an authorization bypass vulnerability in OpenList, a file list program supporting multiple storage. It allows authenticated users with CanShare permission to read files outside their assigned directory by exploiting a flawed path validation check. The issue occurs because the system uses strings.HasPrefix to check file paths without ensuring proper directory separator boundaries. For example, a user with BasePath /base could create a share for /base2/secret.txt and access it via public share endpoints.

Detection Guidance

Check OpenList version with: curl -s https://your-openlist-instance.com/version | grep version. If version is below 4.2.4, the system is vulnerable. Review server logs for unusual share creation requests or public share downloads from unexpected paths.

Impact Analysis

This vulnerability allows unauthorized users to read sensitive files outside their designated directories. Attackers could access confidential data, user files, or system files not meant for them. The impact includes data breaches, loss of data confidentiality, and potential exposure of sensitive information across user boundaries. The CVSS score of 6.5 indicates a medium severity with high confidentiality impact.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, and other data protection regulations due to unauthorized data access. It may result in data breaches that violate confidentiality requirements, leading to legal penalties, fines, and reputational damage. Organizations using affected OpenList versions must patch to avoid compliance violations.

Mitigation Strategies

Upgrade OpenList to version 4.2.4 or later immediately. Review and revoke any suspicious shares created before the upgrade. Monitor for unauthorized file access attempts in logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-69160. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart