Threats Tagged 'ghsa-95cv-r8x4-vh75'

OpenList v4 contains a vulnerability in its batch rename API that allows authenticated users with rename permissions to rename files outside their authorized base directory by using path traversal in the source filename parameter. The API validates the destination name but fails to properly validate the source name, enabling directory traversal and unauthorized file renaming. This affects versions prior to 4.2.4 and has a high severity rating with a CVSS score of 7.6. A patch is available to address this issue.