Threats Tagged 'ghsa-86cx-wwf4-phq4'

OpenList v4 contains an authorization bypass vulnerability in its file sharing API due to improper path prefix validation. An authenticated user with sharing privileges can create share links to files outside their assigned base directory by exploiting a flawed string prefix check that does not consider directory separators. This allows unauthorized read access to arbitrary files in sibling directories, breaking tenant/user isolation. The issue affects versions prior to 4.2.4. The vulnerability enables horizontal privilege escalation by exposing files from other users or internal paths. No known exploits in the wild have been reported.