CVE-2026-73509: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in OpenListTeam OpenList
OpenList a file list program that supports multiple storage. Prior to 4.2.4, the authenticated /api/fs/batch_rename handler in server/handles/fsbatch.go authorizes only the source directory produced by user.JoinPath(req.SrcDir) and validates renameObject.NewName with checkRelativePath, but does not validate attacker-controlled renameObject.SrcName, supplied as src_name, before concatenating it with the authorized path and passing the result to fs.Rename. A user with rename permission can use traversal segments in src_name to make path normalization select a file outside the authorized directory and configured base path, resulting in cross-user file integrity loss, limited availability impact, and file-existence disclosure through success or error responses. This issue is fixed in version 4.2.4.
AI Analysis
Technical Summary
OpenList versions prior to 4.2.4 contain a path traversal vulnerability (CWE-22) in the authenticated /api/fs/batch_rename handler implemented in server/handles/fsbatch.go. The handler authorizes the source directory and validates the new name for renaming but fails to validate the attacker-controlled src_name parameter before concatenation and passing it to fs.Rename. This allows a user with rename permission to use traversal segments in src_name to escape the authorized directory and base path, resulting in unauthorized file access and modification across users. The vulnerability is addressed in version 4.2.4.
Potential Impact
An attacker with rename permission can exploit this vulnerability to rename files outside their authorized directory, causing cross-user file integrity loss, limited availability impact, and disclosure of file existence based on success or error responses. This compromises confidentiality, integrity, and availability to varying degrees.
Mitigation Recommendations
This vulnerability is fixed in OpenList version 4.2.4. Users should upgrade to version 4.2.4 or later to remediate the issue. No other official remediation or temporary fixes are indicated. Patch status is not explicitly confirmed beyond the fix in 4.2.4, so users should verify with vendor advisories for current guidance.
CVE-2026-73509: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in OpenListTeam OpenList
Description
OpenList a file list program that supports multiple storage. Prior to 4.2.4, the authenticated /api/fs/batch_rename handler in server/handles/fsbatch.go authorizes only the source directory produced by user.JoinPath(req.SrcDir) and validates renameObject.NewName with checkRelativePath, but does not validate attacker-controlled renameObject.SrcName, supplied as src_name, before concatenating it with the authorized path and passing the result to fs.Rename. A user with rename permission can use traversal segments in src_name to make path normalization select a file outside the authorized directory and configured base path, resulting in cross-user file integrity loss, limited availability impact, and file-existence disclosure through success or error responses. This issue is fixed in version 4.2.4.
CVSS v3.1
Score 7.6high
Affected software
pkg:github/openlistteam/OpenListRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
OpenList versions prior to 4.2.4 contain a path traversal vulnerability (CWE-22) in the authenticated /api/fs/batch_rename handler implemented in server/handles/fsbatch.go. The handler authorizes the source directory and validates the new name for renaming but fails to validate the attacker-controlled src_name parameter before concatenation and passing it to fs.Rename. This allows a user with rename permission to use traversal segments in src_name to escape the authorized directory and base path, resulting in unauthorized file access and modification across users. The vulnerability is addressed in version 4.2.4.
Potential Impact
An attacker with rename permission can exploit this vulnerability to rename files outside their authorized directory, causing cross-user file integrity loss, limited availability impact, and disclosure of file existence based on success or error responses. This compromises confidentiality, integrity, and availability to varying degrees.
Mitigation Recommendations
This vulnerability is fixed in OpenList version 4.2.4. Users should upgrade to version 4.2.4 or later to remediate the issue. No other official remediation or temporary fixes are indicated. Patch status is not explicitly confirmed beyond the fix in 4.2.4, so users should verify with vendor advisories for current guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-12T19:00:33.736Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a7ddecdbf8831d5395d0172
Added to database: 08/13/2026, 15:12:13 UTC
Last enriched: 08/13/2026, 15:26:10 UTC
Last updated: 08/13/2026, 17:58:36 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.