https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 03:52:30 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-73509 <p>OpenList a file list program that supports multiple storage. Prior to 4.2.4, the authenticated /api/fs/batch_rename handler in server/handles/fsbatch.go authorizes only the source directory produced by user.JoinPath(req.SrcDir) and validates renameObject.NewName with checkRelativePath, but does not validate attacker-controlled renameObject.SrcName, supplied as src_name, before concatenating it with the authorized path and passing the result to fs.Rename. A user with rename permission can use traversal segments in src_name to make path normalization select a file outside the authorized directory and configured base path, resulting in cross-user file integrity loss, limited availability impact, and file-existence disclosure through success or error responses. This issue is fixed in version 4.2.4.</p> <p>OpenList a file list program that supports multiple storage. Prior to 4.2.4, the authenticated /api/fs/batch_rename handler in server/handles/fsbatch.go authorizes only the source directory produced by user.JoinPath(req.SrcDir) and validates renameObject.NewName with checkRelativePath, but does not validate attacker-controlled renameObject.SrcName, supplied as src_name, before concatenating it with the authorized path and passing the result to fs.Rename. A user with rename permission can use traversal segments in src_name to make path normalization select a file outside the authorized directory and configured base path, resulting in cross-user file integrity loss, limited availability impact, and file-existence disclosure through success or error responses. This issue is fixed in version 4.2.4.</p> https://db.gcve.eu/vuln/fkie_cve-2026-73509 https://db.gcve.eu/vuln/ghsa-95cv-r8x4-vh75 <p><strong>Affected:</strong> Go: github.com/OpenListTeam/OpenList/v4</p> <p>### Summary</p> <p>The `/api/fs/batch_rename` handler validates and authorizes only the requested source directory. It rejects path separators in `new_name`, but it does not validate `src_name`. The handler concatenates `src_dir` and attacker-controlled `src_name`, then passes the result to the filesystem rename layer, where the path is normalized.</p> <p>An authenticated user with rename permission can set `src_name` to traversal segments such as `../../ab/secret.txt`. When the user&#39;s base path is `/team/a` and `src_dir` is `/writable`, the authorized directory becomes `/team/a/writable`, but the final source path normalizes to `/team/ab/secret.txt`. The file outside the user&#39;s base path is then renamed.</p> <p>### Details</p> <p>The HTTP API registers filesystem management routes under the authenticated group:</p> <p>- `server/router.go:104` registers `_fs(auth.Group(&#34;/fs&#34;))`. - `server/router.go:198` through `server/router.go:205` expose `/api/fs/batch_rename`.</p> <p>The vulnerable code is in `server/handles/fsbatch.go`:</p> <p>- `src_dir` is constrained through `user.JoinPath(req.SrcDir)` (`server/handles/fsbatch.go:170` through `server/handles/fsbatch.go:174`). - Write permission is checked only for that constrained directory (`server/handles/fsbatch.go:176` through `server/handles/fsbatch.go:185`). - The loop checks `renameObject.NewName` with `checkRelativePath`, but does not check `renameObject.SrcName` (`server/handles/fsbatch.go:186` through `server/handles/fsbatch.go:194`). - The handler builds `filePath…</p> <p><strong>Affected:</strong> Go: github.com/OpenListTeam/OpenList/v4</p> <p>### Summary</p> <p>The `/api/fs/batch_rename` handler validates and authorizes only the requested source directory. It rejects path separators in `new_name`, but it does not validate `src_name`. The handler concatenates `src_dir` and attacker-controlled `src_name`, then passes the result to the filesystem rename layer, where the path is normalized.</p> <p>An authenticated user with rename permission can set `src_name` to traversal segments such as `../../ab/secret.txt`. When the user&#39;s base path is `/team/a` and `src_dir` is `/writable`, the authorized directory becomes `/team/a/writable`, but the final source path normalizes to `/team/ab/secret.txt`. The file outside the user&#39;s base path is then renamed.</p> <p>### Details</p> <p>The HTTP API registers filesystem management routes under the authenticated group:</p> <p>- `server/router.go:104` registers `_fs(auth.Group(&#34;/fs&#34;))`. - `server/router.go:198` through `server/router.go:205` expose `/api/fs/batch_rename`.</p> <p>The vulnerable code is in `server/handles/fsbatch.go`:</p> <p>- `src_dir` is constrained through `user.JoinPath(req.SrcDir)` (`server/handles/fsbatch.go:170` through `server/handles/fsbatch.go:174`). - Write permission is checked only for that constrained directory (`server/handles/fsbatch.go:176` through `server/handles/fsbatch.go:185`). - The loop checks `renameObject.NewName` with `checkRelativePath`, but does not check `renameObject.SrcName` (`server/handles/fsbatch.go:186` through `server/handles/fsbatch.go:194`). - The handler builds `filePath…</p> https://db.gcve.eu/vuln/ghsa-95cv-r8x4-vh75