CVE-2026-103398
Received Received - Intake

OpenSave Path Traversal via Manifest Request

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: VulnCheck

Description
OpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. Attackers can specify arbitrary directories outside configured save locations to read and write files through manifest and sync routes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-09-30
AI Q&A
2026-09-30
EPSS Evaluated
N/A
NVD
CVE-2026-103398
EUVD
EUVD-2026-89993

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
liquid-co opensave to 2.4.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenSave through version 2.4.0 has a flaw where it does not properly validate file save paths provided by connected peers during manifest requests. This allows attackers to specify directories outside the intended save locations, enabling unauthorized reading and writing of files through manifest and sync routes.

Detection Guidance

Check OpenSave application logs for unusual file access or sync events from localhost or paired peers. Inspect network traffic for unauthorized P2P requests to restricted endpoints. Verify if the DangerousSyncRoot function fails to block system directories in sync paths.

Impact Analysis

This vulnerability could allow attackers to access or modify sensitive files on your system by tricking OpenSave into syncing files to unintended locations. This might lead to data theft, corruption, or unauthorized system changes if exploited.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of sensitive data, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using OpenSave may face legal or regulatory penalties if this flaw results in data breaches.

Mitigation Strategies

Update OpenSave to the latest version beyond v2.4.0. Disable P2P sync for sensitive directories. Implement strict path validation in the manifest handler. Ensure signature verification is enforced for all paired peer requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103398. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart