CVE-2026-69160: OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API
OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefix(requestedpath, user.BasePath) without enforcing a directory separator boundary. An authenticated user with CanShare permission and a BasePath such as /base can submit a sibling path such as /base2/secret.txt, create a share for the out-of-scope file, and use the public share download or list handlers to read data outside the assigned directory. This issue is fixed in version 4.2.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenListto a version that resolves this vulnerability.Fixed in 4.2.4
Event History
Frequently Asked Questions
Which deployments and users are exposed?
OpenList versions prior to 4.2.4 are affected when a user has CanShare permission and is assigned a BasePath for which a sibling path can share the same string prefix, such as /base and /base2. The issue is in the share creation and update checks.
What access does an attacker need to exploit this issue?
An attacker needs an authenticated account with CanShare permission and knowledge of an accessible out-of-scope path whose prefix begins with the user's BasePath. No user interaction is required.
What can an attacker do after exploiting the flaw?
The attacker can create a share for the out-of-scope file and then use the public share download or list handlers to read that data. The reported impact is confidentiality loss; integrity and availability impacts are not described.
What is the recommended remediation or temporary mitigation?
Upgrade OpenList to version 4.2.4, which fixes the issue. If an immediate upgrade is not possible, restricting CanShare permission limits the described exploitation path.