Executive brief
OpenList has Insecure TLS Default Configuration in github.com/OpenListTeam/OpenList
Affected products
- Go github.com/OpenListTeam/OpenList/v4
- Go github.com/OpenListTeam/OpenList
- Go github.com/OpenListTeam/OpenList/v3
Junglewise Threat Intelligence
CVE-2026-25060: GO-2026-4397 - OpenList has Insecure TLS Default Configuration in github.com/OpenListTeam/OpenList
CVE-2026-25060 · Severity: low · CVSS 3.1 · Published 2026-02-05
Technologies: github.com/OpenListTeam/OpenList/v4 (Go), github.com/OpenListTeam/OpenList (Go), github.com/OpenListTeam/OpenList/v3 (Go). Vendors: Go.
Related threats
- OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/add_offline
- GO-2026-6110 - OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal in github.com/OpenListTeam/Open
- GO-2026-6113 - OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search in github.com/OpenListTeam/OpenList
- GO-2026-6109 - OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API in github.com/OpenListTeam/OpenList
- OpenList arbitrary file read via path prefix confusion in sharing API