CVE-2026-69160 - OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API
Brief
CVE ID : CVE-2026-69160
Published : Aug. 18, 2026, 6:19 p. m.
- 49 minutes ago
Description : OpenList a file list program that supports multiple storage. Prior to 4.
- 4, the share creation and update checks in server/handles/sharing. go use strings. HasPrefix(requested_path, user. BasePath) without enforcing a directory separator boundary. An authenticated user with CanShare permission and a BasePath such as /base can submit a sibling path such as /base2/secret.
txt, create a share for the out-of-scope file, and use the public share download or list handlers to read data outside the assigned directory. This issue is fixed in version 4.
- 4.
Severity: 6.5
- MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...