OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefix(requested_path, user.BasePath) without enforcing a directory separator boundary. An authenticated user with CanShare permission and a BasePath such as /base can submit a sibling path such as /base2/secret.txt, create a share for the out-of-scope file, and use the public share download or list handlers to read data outside the assigned directory. This issue is fixed in version 4.2.4.

Affected: Go: github.com/OpenListTeam/OpenList/v4

### Summary An authorization bypass vulnerability exists in the file sharing mechanism of `Openlist`. Due to a flawed, non-separator-aware path validation check, an authenticated user can create share links for files outside their restricted base directory. This allows an attacker to bypass tenant/user isolation and gain unauthorized read access to arbitrary files within the system.

### Details When a user attempts to create or update a file share, the application must verify that the requested file path falls within the user's assigned `BasePath`. However, in `server/handles/sharing.go`, this authorization check relies on a simple string prefix function: `strings.HasPrefix(requested_path, user.BasePath)`.

Because `strings.HasPrefix` does not account for directory separators (e.g., `/`), an attacker whose `BasePath` is assigned to `/base` can supply a target path like `/base2/secret_document.txt`. The validation `strings.HasPrefix("/base2/secret_document.txt", "/base")` evaluates to `true`, successfully passing the authorization filter.

Once the share is created, the public share download/list handlers unwrap and serve the file based on the stored absolute path without re-verifying the creator's current directory scope, granting the attacker horizontal access to unauthorized data.

### PoC **Prerequisites:** 1. A system with at least two distinct directories at the root level: `/base` and `/base2`. 2. A sensitive file exists at `/base2/secret.txt`. 3. An attacker account…