OpenList, a file listing program supporting multiple storage backends, has an authorization bypass vulnerability (CWE-639) in versions before 4.2.4. The vulnerability arises because the server's share creation and update logic uses a naive prefix check (strings.HasPrefix) on requested paths without enforcing directory separator boundaries. This allows an authenticated user with CanShare permission and a base path like /base to create shares for sibling paths such as /base2/secret.txt, effectively bypassing directory restrictions and accessing files outside their assigned directory. The vulnerability is addressed in OpenList version 4.2.4.

An authenticated user with sharing permissions can bypass directory restrictions and create shares for files outside their authorized base directory. This leads to unauthorized disclosure of potentially sensitive files via public share download or listing handlers. The vulnerability does not affect confidentiality beyond unauthorized read access and does not impact integrity or availability.

Upgrade OpenList to version 4.2.4 or later, where the issue is fixed. No other mitigation or temporary workaround is documented. Patch status is confirmed fixed in 4.2.4.