The `/api/fs/batch_rename` endpoint in OpenList v4 improperly validates the `src_name` parameter during batch rename operations. While the target directory (`src_dir`) is constrained and authorized, the source filename (`src_name`) is concatenated without sufficient validation, allowing path traversal sequences such as `../../` to escape the authorized directory. This results in renaming files outside the user's base path despite permission checks being limited to the constrained directory. The vulnerability is due to missing validation on `src_name` and path normalization occurring after authorization checks. The flaw is confirmed by a proof-of-concept that demonstrates renaming a file outside the authorized directory by an authenticated user with rename permission but without admin privileges.

An attacker with authenticated access and rename permissions can rename arbitrary files outside their authorized directory by exploiting path traversal in the source filename parameter. This can lead to unauthorized modification of files, potentially impacting confidentiality and integrity of data. The vulnerability does not require administrative privileges but does require rename permission. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict rename permissions to trusted users only and monitor for suspicious rename activity. Avoid exposing the vulnerable batch rename API to untrusted users. Follow vendor updates for an official fix.