Advisory GHSA-86cx-wwf4-phq4 references a vulnerability in the following Go modules:
Description:
Summary
An authorization bypass vulnerability exists in the file sharing mechanism of Openlist. Due to a flawed, non-separator-aware path validation check, an authenticated user can create share links for files outside their restricted base directory. This allows an attacker to bypass tenant/user isolation and gain unauthorized read access to arbitrary files within the system.
Details
When a user attempts to create or update a file share, the application must verify that the requested file path falls within the user's assigned BasePath. However, in server/handles/sharing.go, thi...
References:
Cross references:
- github.com/OpenListTeam/OpenList appears in 2 other report(s):
- github.com/OpenListTeam/OpenList/v3 appears in 2 other report(s):
- github.com/OpenListTeam/OpenList/v4 appears in 2 other report(s):
See doc/quickstart.md for instructions on how to triage this report.
id: GO-ID-PENDING
modules:
- module: github.com/OpenListTeam/OpenList
non_go_versions:
- introduced: TODO (earliest fixed "4.2.4", vuln range "<= 4.2.3")
vulnerable_at: 1.0.6
- module: github.com/OpenListTeam/OpenList/v3
vulnerable_at: 3.45.0
- module: github.com/OpenListTeam/OpenList/v4
vulnerable_at: 4.2.4
summary: 'OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API in github.com/OpenListTeam/OpenList'
ghsas:
- GHSA-86cx-wwf4-phq4
references:
- advisory: https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-86cx-wwf4-phq4
- advisory: https://github.com/advisories/GHSA-86cx-wwf4-phq4
- fix: https://github.com/OpenListTeam/OpenList/commit/59bd3431408578f420895457554700cc9a52375a
- web: https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4
source:
id: GHSA-86cx-wwf4-phq4
created: 2026-07-24T23:02:24.770806591Z
review_status: UNREVIEWED
Advisory GHSA-86cx-wwf4-phq4 references a vulnerability in the following Go modules:
Description:
Summary
An authorization bypass vulnerability exists in the file sharing mechanism of
Openlist. Due to a flawed, non-separator-aware path validation check, an authenticated user can create share links for files outside their restricted base directory. This allows an attacker to bypass tenant/user isolation and gain unauthorized read access to arbitrary files within the system.Details
When a user attempts to create or update a file share, the application must verify that the requested file path falls within the user's assigned
BasePath. However, inserver/handles/sharing.go, thi...References:
Cross references:
See doc/quickstart.md for instructions on how to triage this report.