CVE-2026-102663 (GCVE-0-2026-102663)
Vulnerability from cvelistv5 – Published: 2026-10-12 18:49 – Updated: 2026-10-13 16:01
VLAI
EPSS
VEX
Title
OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search
Summary
OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally indexed Bleve results against a restricted user's BasePath. When Bleve search is enabled and a restricted authenticated user searches the global index for content in a sibling path, the user causes a globally indexed sibling-path result to pass the prefix check. The strings.HasPrefix(node.Parent, user.BasePath) predicate allows a sibling path such as /base2 to be treated as contained by /base. Unauthorized file metadata or file-existence information can be disclosed, and the backend Total value can reveal a match even when another access check removes the individual result. This issue is fixed in version 4.2.4.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 16:00 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/OpenListTeam/OpenList/security… | x_refsource_CONFIRM |
| https://github.com/OpenListTeam/OpenList/commit/5… | x_refsource_MISC |
| https://github.com/OpenListTeam/OpenList/commit/8… | x_refsource_MISC |
| https://github.com/OpenListTeam/OpenList/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| OpenListTeam | OpenList |
Affected:
< 4.2.4
|
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102663",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T16:00:59.279006Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T16:01:30.361Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-p6ph-3jx2-3337"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "OpenList",
"vendor": "OpenListTeam",
"versions": [
{
"status": "affected",
"version": "\u003c 4.2.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally indexed Bleve results against a restricted user\u0027s BasePath. When Bleve search is enabled and a restricted authenticated user searches the global index for content in a sibling path, the user causes a globally indexed sibling-path result to pass the prefix check. The strings.HasPrefix(node.Parent, user.BasePath) predicate allows a sibling path such as /base2 to be treated as contained by /base. Unauthorized file metadata or file-existence information can be disclosed, and the backend Total value can reveal a match even when another access check removes the individual result. This issue is fixed in version 4.2.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T18:49:23.454Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-p6ph-3jx2-3337",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-p6ph-3jx2-3337"
},
{
"name": "https://github.com/OpenListTeam/OpenList/commit/59bd3431408578f420895457554700cc9a52375a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenListTeam/OpenList/commit/59bd3431408578f420895457554700cc9a52375a"
},
{
"name": "https://github.com/OpenListTeam/OpenList/commit/84ecda35aae2bd0020474086e6ddfd3aa2340679",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenListTeam/OpenList/commit/84ecda35aae2bd0020474086e6ddfd3aa2340679"
},
{
"name": "https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4"
}
],
"source": {
"advisory": "GHSA-p6ph-3jx2-3337",
"discovery": "UNKNOWN"
},
"title": "OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-102663",
"datePublished": "2026-10-12T18:49:23.454Z",
"dateReserved": "2026-09-29T15:56:02.102Z",
"dateUpdated": "2026-10-13T16:01:30.361Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-102663",
"date": "2026-10-15",
"epss": "0.00211",
"percentile": "0.10587"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"product": "OpenList",
"vendor": "OpenListTeam",
"versions": [
{
"status": "affected",
"version": "\u003c 4.2.4"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally indexed Bleve results against a restricted user\u0027s BasePath. When Bleve search is enabled and a restricted authenticated user searches the global index for content in a sibling path, the user causes a globally indexed sibling-path result to pass the prefix check. The strings.HasPrefix(node.Parent, user.BasePath) predicate allows a sibling path such as /base2 to be treated as contained by /base. Unauthorized file metadata or file-existence information can be disclosed, and the backend Total value can reveal a match even when another access check removes the individual result. This issue is fixed in version 4.2.4."
}
],
"id": "CVE-2026-102663",
"lastModified": "2026-10-13T17:17:14.363",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-102663",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T16:00:59.279006Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-10-12T19:16:36.190",
"references": [
{
"source": "security-advisories@github.com",
"url": "https://github.com/OpenListTeam/OpenList/commit/59bd3431408578f420895457554700cc9a52375a"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/OpenListTeam/OpenList/commit/84ecda35aae2bd0020474086e6ddfd3aa2340679"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-p6ph-3jx2-3337"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"url": "https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-p6ph-3jx2-3337"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
},
{
"lang": "en",
"value": "CWE-639"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102663",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T16:00:59.279006Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T16:01:19.527Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-p6ph-3jx2-3337"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "OpenList",
"vendor": "OpenListTeam",
"versions": [
{
"status": "affected",
"version": "\u003c 4.2.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally indexed Bleve results against a restricted user\u0027s BasePath. When Bleve search is enabled and a restricted authenticated user searches the global index for content in a sibling path, the user causes a globally indexed sibling-path result to pass the prefix check. The strings.HasPrefix(node.Parent, user.BasePath) predicate allows a sibling path such as /base2 to be treated as contained by /base. Unauthorized file metadata or file-existence information can be disclosed, and the backend Total value can reveal a match even when another access check removes the individual result. This issue is fixed in version 4.2.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T18:49:23.454Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-p6ph-3jx2-3337",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-p6ph-3jx2-3337"
},
{
"name": "https://github.com/OpenListTeam/OpenList/commit/59bd3431408578f420895457554700cc9a52375a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenListTeam/OpenList/commit/59bd3431408578f420895457554700cc9a52375a"
},
{
"name": "https://github.com/OpenListTeam/OpenList/commit/84ecda35aae2bd0020474086e6ddfd3aa2340679",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenListTeam/OpenList/commit/84ecda35aae2bd0020474086e6ddfd3aa2340679"
},
{
"name": "https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4"
}
],
"source": {
"advisory": "GHSA-p6ph-3jx2-3337",
"discovery": "UNKNOWN"
},
"title": "OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-102663",
"datePublished": "2026-10-12T18:49:23.454Z",
"dateReserved": "2026-09-29T15:56:02.102Z",
"dateUpdated": "2026-10-12T18:49:23.454Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
FKIE_CVE-2026-102663
Vulnerability from fkie_nvd - Published: 2026-10-12 19:16 - Updated: 2026-10-13 17:17
Severity
Summary
OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally indexed Bleve results against a restricted user's BasePath. When Bleve search is enabled and a restricted authenticated user searches the global index for content in a sibling path, the user causes a globally indexed sibling-path result to pass the prefix check. The strings.HasPrefix(node.Parent, user.BasePath) predicate allows a sibling path such as /base2 to be treated as contained by /base. Unauthorized file metadata or file-existence information can be disclosed, and the backend Total value can reveal a match even when another access check removes the individual result. This issue is fixed in version 4.2.4.
References
Impacted products
| Vendor | Product | Version |
|---|
{
"affected": [
{
"affectedData": [
{
"product": "OpenList",
"vendor": "OpenListTeam",
"versions": [
{
"status": "affected",
"version": "\u003c 4.2.4"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally indexed Bleve results against a restricted user\u0027s BasePath. When Bleve search is enabled and a restricted authenticated user searches the global index for content in a sibling path, the user causes a globally indexed sibling-path result to pass the prefix check. The strings.HasPrefix(node.Parent, user.BasePath) predicate allows a sibling path such as /base2 to be treated as contained by /base. Unauthorized file metadata or file-existence information can be disclosed, and the backend Total value can reveal a match even when another access check removes the individual result. This issue is fixed in version 4.2.4."
}
],
"id": "CVE-2026-102663",
"lastModified": "2026-10-13T17:17:14.363",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-102663",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T16:00:59.279006Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-10-12T19:16:36.190",
"references": [
{
"source": "security-advisories@github.com",
"url": "https://github.com/OpenListTeam/OpenList/commit/59bd3431408578f420895457554700cc9a52375a"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/OpenListTeam/OpenList/commit/84ecda35aae2bd0020474086e6ddfd3aa2340679"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-p6ph-3jx2-3337"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"url": "https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-p6ph-3jx2-3337"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
},
{
"lang": "en",
"value": "CWE-639"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
GHSA-P6PH-3JX2-3337
Vulnerability from github – Published: 2026-07-24 22:32 – Updated: 2026-07-24 22:32
VLAI
Summary
OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search
Details
Summary
An authorization bypass and information disclosure vulnerability exists in the search API of Openlist. Due to a non-separator-aware path check and unfiltered backend counting, a low-privileged user can bypass their assigned BasePath restrictions to discover and access metadata of files residing in unauthorized sibling directories.
Details
This vulnerability stems from two combined logic flaws when the bleve search engine is utilized:
-
Insecure Path Prefix Validation: In the search handler (
server/handles/search.go), the application attempts to restrict search results to the user's allowed namespace using a simple prefix check:strings.HasPrefix(node.Parent, user.BasePath). Because this function is not path-separator aware, a user with aBasePathrestricted to/basewill successfully pass the authorization check for a completely separate directory named/base2(since "/base2" starts with "/base"). -
Unfiltered Total Count Leakage: The
blevebackend (internal/search/bleve/search.go) searches the index globally and ignores thereq.Parentboundary. Even if the application later successfully filters out unauthorized items from theContentarray (e.g., viaCanAccessmeta password checks), it still returns the rawTotalcount provided by the search backend. This allows an attacker to perform blind data-enumeration, confirming the existence of sensitive files outside their namespace by observing theTotalcount.
PoC
Prerequisites:
1. Log in as an administrator and set the Search Index Mode to bleve. Build the index.
2. Create two directories at the root level: /base and /base2.
3. Upload a sensitive file into the unauthorized directory: /base2/secret_financial_report.pdf.
4. Create a low-privileged test user and strictly set their Base path to /base.
Exploitation Steps: 1. Authenticate as the newly created low-privileged user. 2. Send the following HTTP request to the search API:
POST /api/fs/search HTTP/1.1
Host: <your-openlist-host>
Authorization: <test-user-token>
Content-Type: application/json
{
"parent": "/",
"keywords": "secret",
"page": 1,
"per_page": 20,
"scope": 0
}
- Observe the response: Due to the prefix bypass (
strings.HasPrefix("/base2", "/base") == true), the metadata forsecret_financial_report.pdfwill be leaked in the response Content.- Alternatively, even if access is further blocked by folder-level passwords, the Total field will return > 0, allowing the attacker to blindly confirm the existence of the keyword "secret" in unauthorized global directories.
Impact
This is an Information Disclosure and Horizontal/Vertical Privilege Escalation vulnerability. Any authenticated user can enumerate hidden infrastructure, verify the existence of sensitive files (e.g., passwords, internal documents), and extract file metadata across the entire storage namespace, completely defeating the BasePath isolation mechanism.
Remediation Recommendations
- Separator-Aware Path Containment: Replace strings.HasPrefix with a robust path containment check. For example: target == base || strings.HasPrefix(target, base + "/"), or use a dedicated utility like utils.IsSubPath().
- Backend-Level Filtering: Enforce the path boundary within the bleve query itself (e.g., using indexed parent path hashes) rather than relying solely on post-query API filtering.
- Accurate Total Calculation: Compute the Total count only after all authorization and path filters have been applied to the result set.
Severity
4.3 (Medium)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.2.3"
},
"package": {
"ecosystem": "Go",
"name": "github.com/OpenListTeam/OpenList/v4"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.2.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-24T22:32:17Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\nAn authorization bypass and information disclosure vulnerability exists in the search API of `Openlist`. Due to a non-separator-aware path check and unfiltered backend counting, a low-privileged user can bypass their assigned `BasePath` restrictions to discover and access metadata of files residing in unauthorized sibling directories.\n\n### Details\nThis vulnerability stems from two combined logic flaws when the `bleve` search engine is utilized:\n\n1. **Insecure Path Prefix Validation:** In the search handler (`server/handles/search.go`), the application attempts to restrict search results to the user\u0027s allowed namespace using a simple prefix check: `strings.HasPrefix(node.Parent, user.BasePath)`. Because this function is not path-separator aware, a user with a `BasePath` restricted to `/base` will successfully pass the authorization check for a completely separate directory named `/base2` (since \"/base2\" starts with \"/base\").\n\n2. **Unfiltered Total Count Leakage:** The `bleve` backend (`internal/search/bleve/search.go`) searches the index globally and ignores the `req.Parent` boundary. Even if the application later successfully filters out unauthorized items from the `Content` array (e.g., via `CanAccess` meta password checks), it still returns the raw `Total` count provided by the search backend. This allows an attacker to perform blind data-enumeration, confirming the existence of sensitive files outside their namespace by observing the `Total` count.\n\n### PoC\n**Prerequisites:**\n1. Log in as an administrator and set the Search Index Mode to `bleve`. Build the index.\n2. Create two directories at the root level: `/base` and `/base2`.\n3. Upload a sensitive file into the unauthorized directory: `/base2/secret_financial_report.pdf`.\n4. Create a low-privileged test user and strictly set their `Base path` to `/base`.\n\n**Exploitation Steps:**\n1. Authenticate as the newly created low-privileged user.\n2. Send the following HTTP request to the search API:\n```http\nPOST /api/fs/search HTTP/1.1\nHost: \u003cyour-openlist-host\u003e\nAuthorization: \u003ctest-user-token\u003e\nContent-Type: application/json\n\n{\n \"parent\": \"/\",\n \"keywords\": \"secret\",\n \"page\": 1,\n \"per_page\": 20,\n \"scope\": 0\n}\n```\n3. Observe the response: Due to the prefix bypass (`strings.HasPrefix(\"/base2\", \"/base\") == true`), the metadata for `secret_financial_report.pdf` will be leaked in the response Content.\n - Alternatively, even if access is further blocked by folder-level passwords, the Total field will return \u003e 0, allowing the attacker to blindly confirm the existence of the keyword \"secret\" in unauthorized global directories.\n \n\u003cimg width=\"2112\" height=\"1381\" alt=\"image\" src=\"https://github.com/user-attachments/assets/9f8c5e18-8744-4363-8d3f-5e6cf691f061\" /\u003e\n\n### Impact\nThis is an Information Disclosure and Horizontal/Vertical Privilege Escalation vulnerability. Any authenticated user can enumerate hidden infrastructure, verify the existence of sensitive files (e.g., passwords, internal documents), and extract file metadata across the entire storage namespace, completely defeating the BasePath isolation mechanism.\n\n### Remediation Recommendations\n1. Separator-Aware Path Containment: Replace strings.HasPrefix with a robust path containment check. For example: target == base || strings.HasPrefix(target, base + \"/\"), or use a dedicated utility like utils.IsSubPath().\n2. Backend-Level Filtering: Enforce the path boundary within the bleve query itself (e.g., using indexed parent path hashes) rather than relying solely on post-query API filtering.\n3. Accurate Total Calculation: Compute the Total count only after all authorization and path filters have been applied to the result set.",
"id": "GHSA-p6ph-3jx2-3337",
"modified": "2026-07-24T22:32:17Z",
"published": "2026-07-24T22:32:17Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-p6ph-3jx2-3337"
},
{
"type": "WEB",
"url": "https://github.com/OpenListTeam/OpenList/commit/59bd3431408578f420895457554700cc9a52375a"
},
{
"type": "WEB",
"url": "https://github.com/OpenListTeam/OpenList/commit/84ecda35aae2bd0020474086e6ddfd3aa2340679"
},
{
"type": "PACKAGE",
"url": "https://github.com/OpenListTeam/OpenList"
},
{
"type": "WEB",
"url": "https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search"
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.