CVE-2026-73509

Name of the Vulnerable Software and Affected Versions OpenList versions prior to 4.2.4

Description An authenticated user with rename permissions can perform a path traversal attack via the /api/fs/batch rename endpoint. The handler in server/handles/fsbatch.go fails to validate the src name variable (supplied as renameObject.SrcName) before concatenating it with the authorized path and passing it to the fs.Rename() function. By using traversal segments in src name, an attacker can manipulate path normalization to select files outside the authorized directory and configured base path. This can lead to cross-user file integrity loss, limited availability impact, and disclosure of file existence based on the server responses.

Recommendations Update to version 4.2.4. Avoid using the src name parameter in the /api/fs/batch rename endpoint until the update is applied.