VulnerabilityPublished 07/24/2026

V4: OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API

Affects github.com/OpenListTeam/OpenList/v4Source GCVE Database

CVSS 6.5 Medium · fixed in 4.2.4 : update github.com/OpenListTeam/OpenList/v4 when convenient.

Data as of 07/25/2026, 23:50:07 UTC

CVSS 3.1 base score

6.5Medium

How severe the flaw is on the 0–10 CVSS scale.

Patch: Available – fixed in 4.2.4

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: Low
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: Low: The attacker is authorized with (i.e., requires) privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges may have the ability to cause an impact only to non-sensitive resources.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: High: There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

What to do

Affected software

Product	Affected	Fixed in
Gogithub.com/OpenListTeam/OpenList/v4	Affected <4.2.4	Fixed in 4.2.4

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Recommended mitigation includes replacing the flawed strings.HasPrefix check with a canonical path containment validation that is separator-aware, such as verifying that the target path equals the base path or starts with the base path plus a directory separator. Implement a centralized utility function to consistently validate path containment across all share creation, update, and access handlers to prevent regressions.

Description

OpenList v4 contains an authorization bypass vulnerability in its file sharing API due to improper path prefix validation. An authenticated user with sharing privileges can create share links to files outside their assigned base directory by exploiting a flawed string prefix check that does not consider directory separators. This allows unauthorized read access to arbitrary files in sibling directories, breaking tenant/user isolation. The issue affects versions prior to 4.2.4. The vulnerability enables horizontal privilege escalation by exposing files from other users or internal paths. No known exploits in the wild have been reported.

Impact

This vulnerability allows an attacker with legitimate sharing permissions to bypass directory restrictions and access arbitrary files outside their assigned base directory. It breaks data isolation guarantees by enabling unauthorized read access to sensitive files belonging to other tenants or system areas. The impact is limited to confidentiality (read access), with no integrity or availability impact reported. The severity is moderate due to the requirement of authenticated user privileges and the lack of remote unauthenticated exploitation.

Summary

The vulnerability arises from the use of a simple string prefix check (strings.HasPrefix) to verify that a requested file path is within a user's assigned BasePath during share creation or update. Because this check does not account for directory separators, an attacker with a BasePath of '/base' can specify a path like '/base2/secret.txt', which incorrectly passes the prefix check. Consequently, the attacker can create share links to files outside their authorized directory. The share download and listing handlers serve these files without revalidating directory scope, enabling unauthorized access. The flaw is due to CWE-639 (Authorization Bypass Through User-Controlled Key).

Weaknesses

CWE-639Authorization Bypass Through User-Controlled Key (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #24OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Architecture and Design
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Architecture and Design · Implementation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Architecture and Design
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
OWASP Cheat Sheets
Access Control (opens in a new tab)
Authorization Testing Automation (opens in a new tab)
Cross-Site Request Forgery Prevention (opens in a new tab)
Insecure Direct Object Reference Prevention (opens in a new tab)
Authorization (opens in a new tab)
OWASP ASVS 4.0.3
V4.1.2 (opens in a new tab)
V4.2.1 (opens in a new tab)
V8.3.8 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…