GHSA-95cv-r8x4-vh75: Path Traversal Vulnerability in OpenList Batch Rename Handler
Vulnerability ID: GHSA-95CV-R8X4-VH75
CVSS Score: 7.6
Published: 2026-07-24
A critical path traversal vulnerability has been identified in the OpenList Go-based backend package. The vulnerability exists within the batch rename handler because the application does not validate the source filename parameter before constructing filesystems paths. This omission allows authenticated users to escape their designated directory and rename files in sibling paths.
TL;DR
Authenticated users can rename files outside their base path via path traversal sequences in the batch rename 'src_name' parameter.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-22
- Attack Vector: Network
- CVSS v3.1: 7.6 (High)
- Exploit Status: Proof of Concept
- CISA KEV Status: Not Listed
- Impact: Integrity & Availability Violations
Affected Systems
- OpenList Backend v4.2.3 and below
-
OpenList: <= v4.2.3 (Fixed in:
v4.2.4)
Code Analysis
Commit: 651da18
Fix batch rename path traversal by validating SrcName
Exploit Details
- GitHub Security Advisory: Contains detailed Go-based integration tests reproducing the directory traversal vulnerability
Mitigation Strategies
- Upgrade the package to v4.2.4 or later.
- Implement a Web Application Firewall rule to inspect and block payload containing directory traversal sequences.
- Ensure the application process runs with the minimum required OS-level filesystem privileges.
Remediation Steps:
- Update the Go module using 'go get github.com/OpenListTeam/OpenList/v4@v4.2.4'.
- Run 'go mod tidy' to update the dependency tree.
- Rebuild and redeploy the backend server.
- Verify the fix by attempting a batch rename operation with a '..' sequence.
References
Read the full report for GHSA-95CV-R8X4-VH75 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)