CVE-2026-75602: OpenList SimpleHttp offline-download path traversal arbitrary file write

CVE-2026-75602 · Severity: medium · CVSS 6.5 · Published 2026-09-03

OpenList's offline-download feature allows authenticated users to download files from URLs and save them to the server. An attacker with basic user permissions can manipulate the HTTP response headers to write arbitrary files to the server's filesystem, including configuration files or binaries, potentially achieving full system compromise. This attack works because the application does not validate that downloaded files stay within their intended temporary directory.

Technologies: github.com/OpenListTeam/OpenList (Go), github.com/OpenListTeam/OpenList/v3 (Go), github.com/OpenListTeam/OpenList/v4 (Go). Vendors: Go.

Quick answers

Is CVE-2026-75602 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-75602 being exploited in the wild.
How severe is CVE-2026-75602?
Medium severity, with a CVSS score of 6.5, published 3 September 2026.
Which products and versions are affected?
github.com/OpenListTeam/OpenList (Go) <= 4.2.2, SEMVER:introduced=0, SEMVER:introduced=0,fixed=4.2.3; github.com/OpenListTeam/OpenList/v3 (Go) SEMVER:introduced=0; github.com/OpenListTeam/OpenList/v4 (Go) SEMVER:introduced=0,fixed=4.2.3; OpenListTeam OpenList <= 4.2.2.
Is there a fix for CVE-2026-75602?
Yes. github.com/OpenListTeam/OpenList (Go): upgrade to 4.2.3 or later; github.com/OpenListTeam/OpenList/v4 (Go): upgrade to 4.2.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-75602 attacked?
It is attacked over the network.
Am I affected by CVE-2026-75602?
Check whether you run github.com/OpenListTeam/OpenList (Go), github.com/OpenListTeam/OpenList/v3 (Go), github.com/OpenListTeam/OpenList/v4 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/OpenListTeam/OpenList (Go): upgrade to 4.2.3 or later
    go get github.com/OpenListTeam/OpenList@v4.2.3
  • github.com/OpenListTeam/OpenList/v4 (Go): upgrade to 4.2.3 or later
    go get github.com/OpenListTeam/OpenList/v4@v4.2.3

Technical details

The vulnerability exists in the SimpleHttp offline-download handler (internal/offline_download/http/client.go and util.go). When processing a download request, the application extracts the filename from the HTTP response's Content-Disposition header via parseFilenameFromContentDisposition() without any path sanitization. This unsanitized filename is then passed directly to filepath.Join(task.TempDir, filename), which internally calls filepath.Clean(). While filepath.Clean() normalizes paths, it does not prevent directory traversal sequences like "../" from escaping the intended directory. The resulting path is then opened with os.Create(), which truncates existing files if they exist. The attack requires the attacker to: (1) have a user account with PermAddOfflineDownload permission on any path, (2) control a web server to serve the malicious Content-Disposition header, (3) trigger the offline-download API endpoint POST /api/fs/add_offline_download. The attacker can write files to any location where the parent directory already exists. Patch versions 4.2.3+ apply filepath.Base() to the filename and validate it is local, along with additional containment checks.

Affected products

  • OpenListTeam OpenList <= 4.2.2

Identifiers

  • CVE-2026-75602
  • GHSA-h6cj-26g5-67fv
  • GO-2026-6368

Timeline

  • 2026-07-09: disclosed: Initial GitHub Advisory publication
  • 2026-09-03: advisory: CVE-2026-75602 published; advisory updated
  • 2026-09-03: patched: Patched in OpenList v4.2.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.