CVE-2026-102663
Deferred Deferred - Pending Action

Path Traversal in OpenList File List Program

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: GitHub, Inc.

Description
OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally indexed Bleve results against a restricted user's BasePath. When Bleve search is enabled and a restricted authenticated user searches the global index for content in a sibling path, the user causes a globally indexed sibling-path result to pass the prefix check. The strings.HasPrefix(node.Parent, user.BasePath) predicate allows a sibling path such as /base2 to be treated as contained by /base. Unauthorized file metadata or file-existence information can be disclosed, and the backend Total value can reveal a match even when another access check removes the individual result. This issue is fixed in version 4.2.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-13
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-102663
EUVD
EUVD-2026-97775

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
OpenListTeam OpenList < 4.2.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in the OpenList search API when using the Bleve search engine. It occurs because the code uses a non-separator-aware strings.HasPrefix comparison to check if a file path is within a user's authorized BasePath. This allows paths like /base2 to be incorrectly treated as part of /base, enabling unauthorized access to file metadata or existence in sibling directories.

Detection Guidance

To detect this vulnerability, check if your OpenList instance is running a version prior to 4.2.4. Use commands like 'curl -s https://your-openlist-instance.com/version' or inspect the server logs for version details. If vulnerable, unauthorized users may access file metadata or existence via search results.

Impact Analysis

An authenticated user with restricted access could view metadata or confirm the existence of files outside their authorized scope. This could lead to information disclosure, such as learning about files they shouldn't access, even if they cannot retrieve the actual file content.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection such as GDPR (Article 32) and HIPAA (Security Rule). It may result in unauthorized data exposure, potentially leading to regulatory penalties or breaches of confidentiality.

Mitigation Strategies

Upgrade OpenList to version 4.2.4 or later immediately. If upgrading is not possible, disable the Bleve search feature or restrict access to the search API until patched. Review user permissions and shared paths to ensure no unauthorized access is occurring.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102663. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart