CVE-2026-69160

Name of the Vulnerable Software and Affected Versions OpenList versions prior to 4.2.4

Description An issue exists in the share creation and update checks within the server/handles/sharing.go file. The system uses the strings.HasPrefix() function to validate the requested path against the user.BasePath but fails to enforce a directory separator boundary. This allows an authenticated user with CanShare permission to provide a sibling path, such as /base2/secret.txt when their base path is /base, enabling them to create shares for files outside their assigned directory and access them via public share download or list handlers.

Recommendations Update to version 4.2.4.