GHSA-86CX-WWF4-PHQ4: GHSA-86cx-wwf4-phq4: Path Prefix Confusion Authorization Bypass in OpenList

#security #cve #cybersecurity #ghsa

GHSA-86cx-wwf4-phq4: Path Prefix Confusion Authorization Bypass in OpenList

Vulnerability ID: GHSA-86CX-WWF4-PHQ4
CVSS Score: 6.5
Published: 2026-07-24

An authorization bypass vulnerability in OpenList version 4.2.3 and below allows authenticated users to read arbitrary files outside of their designated base directories due to an insecure path prefix check using Go's standard strings.HasPrefix function.

TL;DR

OpenList version 4.2.3 and below is vulnerable to an authorization bypass where authenticated users can access sibling directories due to literal string prefix matching on user base paths.

Technical Details

CWE ID: CWE-639: Authorization Bypass Through User-Controlled Key
Attack Vector: Network (AV:N)
CVSS v3.1 Score: 6.5 (Medium)
EPSS Score: Not Applicable
Impact: Arbitrary File Read / Authorization Bypass
Exploit Status: Proof of Concept (PoC) documented
CISA KEV Status: Not Listed

Affected Systems

OpenList <= 4.2.3
OpenList: <= 4.2.3 (Fixed in: 4.2.4)

Code Analysis

Commit: 59bd343

Fix: Use utils.IsSubPath instead of strings.HasPrefix to validate paths and add dynamic permission re-validation in sharing unwrapper.

Mitigation Strategies

Upgrade OpenList to version 4.2.4 or later.
Append a trailing slash to all user BasePaths in the database configuration.
Temporarily revoke sharing privileges (CanShare) for untrusted accounts.

Remediation Steps:

Deploy OpenList version 4.2.4.
Inspect the database for share records referencing files outside their owner's intended directory structure.
Update user configurations to enforce slash-terminated base directories if running a legacy version.

References

Read the full report for GHSA-86CX-WWF4-PHQ4 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community