Vulnerability · Published Aug 18, 2026 · Assigned by GitHub_M
CVE-2026-69160OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API
Medium 6.5
In plain English
A medium-severity authorization bypass via user-controlled key in OpenList from OpenListTeam. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefix(requested_path, user.BasePath) without enforcing a directory separator boundary. An authenticated user with CanShare permission and a BasePath such as /base can submit a sibling path such as /base2/secret.txt, create a share for the out-of-scope file, and use the public share download or list handlers to read data outside the assigned directory. This issue is fixed in version 4.2.4.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/OpenListTeam/OpenList | no fix listed | GO-2026-6109 |
| Go | github.com/OpenListTeam/OpenList/v3 | no fix listed | GO-2026-6109 |
| Go | github.com/OpenListTeam/OpenList/v4 | 4.2.4 | GHSA-86cx-wwf4-phq4 |
| Go | github.com/OpenListTeam/OpenList/v4 | 4.2.4 | GO-2026-6109 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| OpenListTeam | OpenList | < 4.2.4 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N