CVE-2026-69160: falha de média gravidade em OpenListTeam OpenList
OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.5epss 0.4%
OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefix(requested_path, user.BasePath) without enforcing a directory separator boundary. An authenticated user with CanShare permission and a BasePath such as /base can submit a sibling path such as /base2/secret.txt, create a share for the out-of-scope file, and use the public share download or list handlers to read data outside the assigned directory. This issue is fixed in version 4.2.4.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
OpenListTeam · OpenListCVEs relacionadas — OpenListTeam OpenList
No mesmo produto, das mais perigosas para as menos.
CVE-2026-75602MEDIUMOpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download toolEPSS 0.7%CVE-2026-25059HIGHOpenList affected by Path Traversal in file copy and remove handlersEPSS 0.7%CVE-2026-73509HIGHOpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversalEPSS 0.5%CVE-2025-50183MEDIUMOpenList (frontend) allows XSS Attacks in the built-in Markdown ViewerEPSS 0.3%CVE-2026-102663MEDIUMOpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve SearchEPSS 0.3%CVE-2026-25060HIGHOpenList Insecure TLS Default ConfigurationEPSS 0.3%