Threats affecting pkg:github/OpenSave

2 threats

Severity	CVSS	Signals	Threat	Source	Published	Score and star
High	8.6	EPSS 0.3%	CVE-2026-103398Liquid-co OpenSave · External Control of File Name or Path High8.6EPSS 0.3%2026-09-30CVE Database V5CVE-2026-103398 CVE-2026-103398 is a vulnerability in Liquid-co's OpenSave product up to version 2.4.0. It involves improper validation of save paths supplied by paired peers in the manifest request handler, allowing attackers to specify arbitrary directories outside the configured save locations. This can lead to unauthorized reading and writing of files through manifest and sync routes. The vulnerability has a high severity with a CVSS score of 8.6. EPSS 0.3%Vulnerability	CVE Database V5	2026-09-30
Medium	6.3	EPSS 0.2%	CVE-2026-103397Liquid-co OpenSave · Authentication Bypass by Spoofing Medium6.3EPSS 0.2%2026-09-30CVE Database V5CVE-2026-103397 CVE-2026-103397 is an authentication bypass vulnerability in Liquid-co OpenSave versions before 2.4.0-beta.1. The flaw allows attackers who know the room code to spoof the RelayMessage From field in WAN relay requests, impersonating paired devices. This enables unauthorized access to protected synchronization routes, including save data, snapshots, and file operations. EPSS 0.2%Vulnerability	CVE Database V5	2026-09-30

Page 1 of 1