CVE-2026-25059

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25059", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-28T14:50:47.889Z", "datePublished": "2026-02-02T22:24:40.744Z", "dateUpdated": "2026-02-04T16:53:37.480Z"}, "containers": {"cna": {"title": "OpenList affected by Path Traversal in file copy and remove handlers", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-qmj2-8r24-xxcq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-qmj2-8r24-xxcq"}, {"name": "https://github.com/OpenListTeam/OpenList/commit/7b78fed106382430c69ef351d43f5d09928fff14", "tags": ["x_refsource_MISC"], "url": "https://github.com/OpenListTeam/OpenList/commit/7b78fed106382430c69ef351d43f5d09928fff14"}, {"name": "https://github.com/OpenListTeam/OpenList/releases/tag/v4.1.10", "tags": ["x_refsource_MISC"], "url": "https://github.com/OpenListTeam/OpenList/releases/tag/v4.1.10"}], "affected": [{"vendor": "OpenListTeam", "product": "OpenList", "versions": [{"version": "< 4.1.10", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-02T22:24:40.744Z"}, "descriptions": [{"lang": "en", "value": "OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, the application contains path traversal vulnerability in multiple file operation handlers in server/handles/fsmanage.go. Filename components in req.Names are directly concatenated with validated directories using stdpath.Join. This allows \"..\" sequences to bypass path restrictions, enabling users to access other users' files within the same storage mount and perform unauthorized actions such as deletion, renaming, or copying of files. An authenticated attacker can bypass directory-level authorisation by injecting traversal sequences into filename components, enabling unauthorised file removal and copying across user boundaries within the same storage mount. This vulnerability is fixed in 4.1.10."}], "source": {"advisory": "GHSA-qmj2-8r24-xxcq", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-04T15:54:29.932114Z", "id": "CVE-2026-25059", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T16:53:37.480Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25059", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-04T15:54:29.932114Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T15:54:31.024Z"}}], "cna": {"title": "OpenList affected by Path Traversal in file copy and remove handlers", "source": {"advisory": "GHSA-qmj2-8r24-xxcq", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "OpenListTeam", "product": "OpenList", "versions": [{"status": "affected", "version": "< 4.1.10"}]}], "references": [{"url": "https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-qmj2-8r24-xxcq", "name": "https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-qmj2-8r24-xxcq", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/OpenListTeam/OpenList/commit/7b78fed106382430c69ef351d43f5d09928fff14", "name": "https://github.com/OpenListTeam/OpenList/commit/7b78fed106382430c69ef351d43f5d09928fff14", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/OpenListTeam/OpenList/releases/tag/v4.1.10", "name": "https://github.com/OpenListTeam/OpenList/releases/tag/v4.1.10", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, the application contains path traversal vulnerability in multiple file operation handlers in server/handles/fsmanage.go. Filename components in req.Names are directly concatenated with validated directories using stdpath.Join. This allows \"..\" sequences to bypass path restrictions, enabling users to access other users' files within the same storage mount and perform unauthorized actions such as deletion, renaming, or copying of files. An authenticated attacker can bypass directory-level authorisation by injecting traversal sequences into filename components, enabling unauthorised file removal and copying across user boundaries within the same storage mount. This vulnerability is fixed in 4.1.10."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-02T22:24:40.744Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25059", "state": "PUBLISHED", "dateUpdated": "2026-02-04T16:53:37.480Z", "dateReserved": "2026-01-28T14:50:47.889Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-02T22:24:40.744Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "OpenList", "vendor": "OpenListTeam", "versions": [{"status": "affected", "version": "< 4.1.10"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oplist:openlist:*:*:*:*:*:*:*:*", "matchCriteriaId": "8A540671-DE84-45FD-A087-21A565765CF4", "versionEndExcluding": "4.1.10", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, the application contains path traversal vulnerability in multiple file operation handlers in server/handles/fsmanage.go. Filename components in req.Names are directly concatenated with validated directories using stdpath.Join. This allows \"..\" sequences to bypass path restrictions, enabling users to access other users' files within the same storage mount and perform unauthorized actions such as deletion, renaming, or copying of files. An authenticated attacker can bypass directory-level authorisation by injecting traversal sequences into filename components, enabling unauthorised file removal and copying across user boundaries within the same storage mount. This vulnerability is fixed in 4.1.10."}, {"lang": "es", "value": "OpenList Frontend es un componente de UI para OpenList. Antes de la 4.1.10, la aplicaci\u00f3n contiene una vulnerabilidad de salto de ruta en m\u00faltiples manejadores de operaciones de archivo en server/handles/fsmanage.go. Los componentes de nombre de archivo en req.Names se concatenan directamente con directorios validados usando stdpath.Join. Esto permite que las secuencias '..' evadan las restricciones de ruta, permitiendo a los usuarios acceder a los archivos de otros usuarios dentro del mismo montaje de almacenamiento y realizar acciones no autorizadas como la eliminaci\u00f3n, el cambio de nombre o la copia de archivos. Un atacante autenticado puede evadir la autorizaci\u00f3n a nivel de directorio inyectando secuencias de salto de ruta en los componentes de nombre de archivo, permitiendo la eliminaci\u00f3n y copia de archivos no autorizadas entre l\u00edmites de usuario dentro del mismo montaje de almacenamiento. Esta vulnerabilidad est\u00e1 corregida en la 4.1.10."}], "id": "CVE-2026-25059", "lastModified": "2026-06-17T10:24:03.673", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25059", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-04T15:54:29.932114Z", "version": "2.0.3"}}]}, "published": "2026-02-02T23:16:08.753", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/OpenListTeam/OpenList/commit/7b78fed106382430c69ef351d43f5d09928fff14"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/OpenListTeam/OpenList/releases/tag/v4.1.10"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-qmj2-8r24-xxcq"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T00:30:36.354467+00:00", "value": {"mitigation_remediation": ["Upgrade OpenList to version 4.1.10 or later to apply the official patch that removes the path traversal flaw.", "If an immediate upgrade is infeasible, add strict server\u2011side validation to strip or reject any \"..\" sequences from filename components before they are processed by the file copy or remove handlers.", "Implement per\u2011user storage isolation or mount segregation so that even if traversal occurs, it cannot reach files owned by other users, adding an additional layer of protection."], "summary": {"action": "Upgrade", "impact": "Unauthorized File Access and Modification"}, "threat_synthesis": {"affected_systems": "All OpenList releases prior to version 4.1.10 are affected. The vulnerability resides in the OpenList frontend component, specifically in the file management handlers under server/handles/fsmanage.go. The affected vendor is OpenListTeam, product OpenList. Users running any version before 4.1.10 should consider themselves at risk if they provide authenticated file manipulation capabilities.", "description_and_impact": "A path traversal vulnerability in OpenList\u2019s file operation handlers allows an attacker with authenticated access to craft filenames containing \"..\" sequences, bypassing validated directory restrictions. This flaw enables reading, deleting, renaming, or copying files belonging to other users within the same storage mount, compromising confidentiality, integrity, and potentially availability of those files.", "risk_and_exploitability": "The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at the time of this analysis. The flaw is classified as CWE\u201122 (Path Traversal) and requires an authenticated attacker who can invoke the file copy or remove endpoints. Once authenticated, the attacker can inject traversal sequences into filename components, thereby bypassing directory-level authorization and performing unauthorized file operations across user boundaries. The vulnerability is not currently listed in the CISA KEV catalog."}}}}, "created": "2026-02-04T12:18:06.569376+00:00", "updated": "2026-04-18T00:45:32.227590+00:00", "vendors": ["openlistteam", "openlistteam$PRODUCT$openlist"]}