Vulnerability · Published Aug 13, 2026 · Assigned by GitHub_M
CVE-2026-73509OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal
High 7.6
In plain English
A high-severity path traversal in OpenList from OpenListTeam. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OpenList a file list program that supports multiple storage. Prior to 4.2.4, the authenticated /api/fs/batch_rename handler in server/handles/fsbatch.go authorizes only the source directory produced by user.JoinPath(req.SrcDir) and validates renameObject.NewName with checkRelativePath, but does not validate attacker-controlled renameObject.SrcName, supplied as src_name, before concatenating it with the authorized path and passing the result to fs.Rename. A user with rename permission can use traversal segments in src_name to make path normalization select a file outside the authorized directory and configured base path, resulting in cross-user file integrity loss, limited availability impact, and file-existence disclosure through success or error responses. This issue is fixed in version 4.2.4.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/OpenListTeam/OpenList | no fix listed | GO-2026-6110 |
| Go | github.com/OpenListTeam/OpenList/v3 | no fix listed | GO-2026-6110 |
| Go | github.com/OpenListTeam/OpenList/v4 | 4.2.4 | GHSA-95cv-r8x4-vh75 |
| Go | github.com/OpenListTeam/OpenList/v4 | 4.2.4 | GO-2026-6110 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| OpenListTeam | OpenList | < 4.2.4 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L