Threats Tagged 'cve-2026-73509'

OpenList a file list program that supports multiple storage. Prior to 4.2.4, the authenticated /api/fs/batch_rename handler in server/handles/fsbatch.go authorizes only the source directory produced by user.JoinPath(req.SrcDir) and validates renameObject.NewName with checkRelativePath, but does not validate attacker-controlled renameObject.SrcName, supplied as src_name, before concatenating it with the authorized path and passing the result to fs.Rename. A user with rename permission can use traversal segments in src_name to make path normalization select a file outside the authorized directory and configured base path, resulting in cross-user file integrity loss, limited availability impact, and file-existence disclosure through success or error responses. This issue is fixed in version 4.2.4.

OpenList v4 contains a vulnerability in its batch rename API that allows authenticated users with rename permissions to rename files outside their authorized base directory by using path traversal in the source filename parameter. The API validates the destination name but fails to properly validate the source name, enabling directory traversal and unauthorized file renaming. This affects versions prior to 4.2.4 and has a high severity rating with a CVSS score of 7.6. A patch is available to address this issue.