OpenListTeam has 8 CVEs on record. Disclosure cadence is accelerating: 5 in the last 90 days against 3 in the 90 before. The busiest recent month was July 2026 with 3. The median CVSS is 6.5 (medium). None have a confirmed exploitation report. The dominant weakness classes are CWE-639 (4) and CWE-22 (3). Most affected products: github.com/OpenListTeam/OpenList/v4 (6), github.com/OpenListTeam/OpenList (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 5 prev 3
Products
- github.com/OpenListTeam/OpenList/v4 6
- github.com/OpenListTeam/OpenList 2
Worst active — by depth score
CVE-2026-73509High· 7.6OpenList a file list program that supports multiple storage42GHSA-95cv-r8x4-vh75High· 7.6OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal42CVE-2026-102663Medium· 4.3OpenList is a file list program that supports multiple storage backends36CVE-2026-75602Medium· 6.5OpenList a file list program that supports multiple storage36CVE-2026-69160Medium· 6.5OpenList a file list program that supports multiple storage36
OpenListTeam vulnerabilities
CVEs affecting OpenListTeam, newest first. Open any entry for full detail, references, and exploit status.
8 CVEsRSS
CVE-2026-102663Medium· 4.3PoCOpenList is a file list program that supports multiple storage backends
OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally …
CVE-2026-75602Medium· 6.5OpenList a file list program that supports multiple storage
OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/add_offline_download with tool: "SimpleHttp" accepts an attacker-supplied URL and saves its bytes under a pe…
GO-2026-6113NoneOpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search in github.com/OpenListTeam/OpenList
OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search in github.com/OpenListTeam/OpenList
CVE-2026-69160Medium· 6.5OpenList a file list program that supports multiple storage
OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefix(requested_path, user.BasePath) without enforcing a directory separator b…
CVE-2026-73509High· 7.6OpenList a file list program that supports multiple storage
OpenList a file list program that supports multiple storage. Prior to 4.2.4, the authenticated /api/fs/batch_rename handler in server/handles/fsbatch.go authorizes only the source directory produced by user.JoinPath(req.SrcDir) and valid…
GHSA-95cv-r8x4-vh75High· 7.6OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal
OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal
GHSA-p6ph-3jx2-3337Medium· 4.3OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search
OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search
GHSA-86cx-wwf4-phq4Medium· 6.5OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API
OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API