github.com/OpenListTeam/OpenList/v4 vulnerabilities
CVEs whose affected-version data names the github.com/OpenListTeam/OpenList/v4 package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
7 CVEsRSS
CVE-2026-102663Medium· 4.3PoCOpenList is a file list program that supports multiple storage backends
OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally …
GO-2026-6113NoneOpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search in github.com/OpenListTeam/OpenList
OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search in github.com/OpenListTeam/OpenList
CVE-2026-69160Medium· 6.5OpenList a file list program that supports multiple storage
OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefix(requested_path, user.BasePath) without enforcing a directory separator b…
CVE-2026-73509High· 7.6OpenList a file list program that supports multiple storage
OpenList a file list program that supports multiple storage. Prior to 4.2.4, the authenticated /api/fs/batch_rename handler in server/handles/fsbatch.go authorizes only the source directory produced by user.JoinPath(req.SrcDir) and valid…
GHSA-95cv-r8x4-vh75High· 7.6OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal
OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal
GHSA-p6ph-3jx2-3337Medium· 4.3OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search
OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search
GHSA-86cx-wwf4-phq4Medium· 6.5OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API
OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API