https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 23:45:20 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-69160 <p>OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefix(requested_path, user.BasePath) without enforcing a directory separator boundary. An authenticated user with CanShare permission and a BasePath such as /base can submit a sibling path such as /base2/secret.txt, create a share for the out-of-scope file, and use the public share download or list handlers to read data outside the assigned directory. This issue is fixed in version 4.2.4.</p> <p>OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefix(requested_path, user.BasePath) without enforcing a directory separator boundary. An authenticated user with CanShare permission and a BasePath such as /base can submit a sibling path such as /base2/secret.txt, create a share for the out-of-scope file, and use the public share download or list handlers to read data outside the assigned directory. This issue is fixed in version 4.2.4.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-69160 https://vulnerability.circl.lu/vuln/ghsa-86cx-wwf4-phq4 <p><strong>Affected:</strong> Go: github.com/OpenListTeam/OpenList/v4</p> <p>### Summary An authorization bypass vulnerability exists in the file sharing mechanism of `Openlist`. Due to a flawed, non-separator-aware path validation check, an authenticated user can create share links for files outside their restricted base directory. This allows an attacker to bypass tenant/user isolation and gain unauthorized read access to arbitrary files within the system.</p> <p>### Details When a user attempts to create or update a file share, the application must verify that the requested file path falls within the user&#39;s assigned `BasePath`. However, in `server/handles/sharing.go`, this authorization check relies on a simple string prefix function: `strings.HasPrefix(requested_path, user.BasePath)`.</p> <p>Because `strings.HasPrefix` does not account for directory separators (e.g., `/`), an attacker whose `BasePath` is assigned to `/base` can supply a target path like `/base2/secret_document.txt`. The validation `strings.HasPrefix(&#34;/base2/secret_document.txt&#34;, &#34;/base&#34;)` evaluates to `true`, successfully passing the authorization filter.</p> <p>Once the share is created, the public share download/list handlers unwrap and serve the file based on the stored absolute path without re-verifying the creator&#39;s current directory scope, granting the attacker horizontal access to unauthorized data.</p> <p>### PoC **Prerequisites:** 1. A system with at least two distinct directories at the root level: `/base` and `/base2`. 2. A sensitive file exists at `/base2/secret.txt`. 3. An attacker account…</p> <p><strong>Affected:</strong> Go: github.com/OpenListTeam/OpenList/v4</p> <p>### Summary An authorization bypass vulnerability exists in the file sharing mechanism of `Openlist`. Due to a flawed, non-separator-aware path validation check, an authenticated user can create share links for files outside their restricted base directory. This allows an attacker to bypass tenant/user isolation and gain unauthorized read access to arbitrary files within the system.</p> <p>### Details When a user attempts to create or update a file share, the application must verify that the requested file path falls within the user&#39;s assigned `BasePath`. However, in `server/handles/sharing.go`, this authorization check relies on a simple string prefix function: `strings.HasPrefix(requested_path, user.BasePath)`.</p> <p>Because `strings.HasPrefix` does not account for directory separators (e.g., `/`), an attacker whose `BasePath` is assigned to `/base` can supply a target path like `/base2/secret_document.txt`. The validation `strings.HasPrefix(&#34;/base2/secret_document.txt&#34;, &#34;/base&#34;)` evaluates to `true`, successfully passing the authorization filter.</p> <p>Once the share is created, the public share download/list handlers unwrap and serve the file based on the stored absolute path without re-verifying the creator&#39;s current directory scope, granting the attacker horizontal access to unauthorized data.</p> <p>### PoC **Prerequisites:** 1. A system with at least two distinct directories at the root level: `/base` and `/base2`. 2. A sensitive file exists at `/base2/secret.txt`. 3. An attacker account…</p> https://vulnerability.circl.lu/vuln/ghsa-86cx-wwf4-phq4