CVE-2026-75602: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in OpenListTeam OpenList

OpenList's offline-download feature in versions before 4.2.3 improperly limits pathname traversal when handling attacker-controlled filenames from the Content-Disposition header. The filename is joined with a temporary directory path without containment checks, allowing traversal outside the intended directory. This occurs because filepath.Join cleans '..' segments but does not prevent escaping the temporary directory. A non-admin user with PermAddOfflineDownload permission can exploit this to create, truncate, or overwrite files writable by the OpenList process if the parent directory exists. The vulnerable code path is in SimpleHttp.Run and is reachable via the AddOfflineDownload route, which uses normal user authentication rather than admin authentication. The vulnerability is addressed in version 4.2.3.

An attacker with the PermAddOfflineDownload permission can perform path traversal to write arbitrary files on the server with the privileges of the OpenList process. This can lead to integrity violations by overwriting or creating files, potentially affecting system stability or security. The vulnerability does not allow direct confidentiality breaches but impacts integrity and availability. The CVSS score is 6.5 (medium severity) reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impact.

Upgrade OpenList to version 4.2.3 or later where this path traversal vulnerability is fixed. Until upgrading, restrict the PermAddOfflineDownload permission to trusted users only, as exploitation requires this privilege. There is no indication of an official patch or temporary workaround other than upgrading. Monitor vendor advisories for any additional mitigation guidance.