CVE-2026-75602

Name of the Vulnerable Software and Affected Versions OpenList versions prior to 4.2.3

Description The offline-download feature at the 'POST /api/fs/add offline download' endpoint is susceptible to path traversal when using the tool: "SimpleHttp" configuration. The application accepts a user-supplied URL and retrieves the filename from the Content-Disposition header of the response. This filename is passed to the filepath.Join() function in internal/offline download/http/client.go and opened via os.Create() without proper containment checks. Because filepath.Join() cleans .. segments, a non-admin user with PermAddOfflineDownload permissions can provide a malicious filename to traverse out of the temporary directory. This allows the attacker to create, truncate, or overwrite any file writable by the OpenList process, provided the parent directory already exists. Potential impacts include replacing the config.json file to achieve administrative takeover or dropping a webshell into a writable directory.

Recommendations Update OpenList to version 4.2.3. As a temporary mitigation, restrict the PermAddOfflineDownload permission to trusted users only. Restrict the use of the tool: "SimpleHttp" parameter in the 'POST /api/fs/add offline download' endpoint until the update is applied.