Executive brief
OpenList's offline-download feature allows authenticated users to download files from URLs and save them to the server. An attacker with basic user permissions can manipulate the HTTP response headers to write arbitrary files to the server's filesystem, including configuration files or binaries, potentially achieving full system compromise. This attack works because the application does not validate that downloaded files stay within their intended temporary directory.
Technical details
The vulnerability exists in the SimpleHttp offline-download handler (internal/offline_download/http/client.go and util.go). When processing a download request, the application extracts the filename from the HTTP response's Content-Disposition header via parseFilenameFromContentDisposition() without any path sanitization. This unsanitized filename is then passed directly to filepath.Join(task.TempDir, filename), which internally calls filepath.Clean(). While filepath.Clean() normalizes paths, it does not prevent directory traversal sequences like "../" from escaping the intended directory. The resulting path is then opened with os.Create(), which truncates existing files if they exist. The attack requires the attacker to: (1) have a user account with PermAddOfflineDownload permission on any path, (2) control a web server to serve the malicious Content-Disposition header, (3) trigger the offline-download API endpoint POST /api/fs/add_offline_download. The attacker can write files to any location where the parent directory already exists. Patch versions 4.2.3+ apply filepath.Base() to the filename and validate it is local, along with additional containment checks.
Affected products
- OpenListTeam OpenList <= 4.2.2
Timeline
- 2026-07-09: disclosed: Initial GitHub Advisory publication
- 2026-09-03: advisory: CVE-2026-75602 published; advisory updated
- 2026-09-03: patched: Patched in OpenList v4.2.3
References
- https://api.github.com/users/ILoveScratch2
- https://github.com/ILoveScratch2
- https://api.github.com/users/ILoveScratch2/gists%7B/gist_id%7D
- https://api.github.com/users/ILoveScratch2/repos
- https://avatars.githubusercontent.com/u/161606492?v=4
- https://api.github.com/users/ILoveScratch2/events%7B/privacy%7D