# CVE-2026-75602: OpenList SimpleHttp offline-download path traversal arbitrary file write

Source: https://junglewise.ai/threats/cve-2026-75602-openlist-simplehttp-offline-download-path-traversal-arbitrary  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-75602 · Severity: medium · CVSS 6.5 · Published 2026-09-03

OpenList's offline-download feature allows authenticated users to download files from URLs and save them to the server. An attacker with basic user permissions can manipulate the HTTP response headers to write arbitrary files to the server's filesystem, including configuration files or binaries, potentially achieving full system compromise. This attack works because the application does not validate that downloaded files stay within their intended temporary directory.

Technologies: [github.com/OpenListTeam/OpenList (Go)](https://junglewise.ai/threats/technologies/github-com-openlistteam-openlist), [github.com/OpenListTeam/OpenList/v3 (Go)](https://junglewise.ai/threats/technologies/github-com-openlistteam-openlist-v3), [github.com/OpenListTeam/OpenList/v4 (Go)](https://junglewise.ai/threats/technologies/github-com-openlistteam-openlist-v4). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-75602 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75602 being exploited in the wild.

**How severe is CVE-2026-75602?** Medium severity, with a CVSS score of 6.5, published 3 September 2026.

**Which products and versions are affected?** github.com/OpenListTeam/OpenList (Go) <= 4.2.2, SEMVER:introduced=0, SEMVER:introduced=0,fixed=4.2.3; github.com/OpenListTeam/OpenList/v3 (Go) SEMVER:introduced=0; github.com/OpenListTeam/OpenList/v4 (Go) SEMVER:introduced=0,fixed=4.2.3; OpenListTeam OpenList <= 4.2.2.

**Is there a fix for CVE-2026-75602?** Yes. github.com/OpenListTeam/OpenList (Go): upgrade to 4.2.3 or later; github.com/OpenListTeam/OpenList/v4 (Go): upgrade to 4.2.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75602 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-75602?** Check whether you run github.com/OpenListTeam/OpenList (Go), github.com/OpenListTeam/OpenList/v3 (Go), github.com/OpenListTeam/OpenList/v4 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/OpenListTeam/OpenList (Go): upgrade to 4.2.3 or later

  ```sh
  go get github.com/OpenListTeam/OpenList@v4.2.3
  ```

- github.com/OpenListTeam/OpenList/v4 (Go): upgrade to 4.2.3 or later

  ```sh
  go get github.com/OpenListTeam/OpenList/v4@v4.2.3
  ```


## Technical details

The vulnerability exists in the SimpleHttp offline-download handler (internal/offline_download/http/client.go and util.go). When processing a download request, the application extracts the filename from the HTTP response's Content-Disposition header via parseFilenameFromContentDisposition() without any path sanitization. This unsanitized filename is then passed directly to filepath.Join(task.TempDir, filename), which internally calls filepath.Clean(). While filepath.Clean() normalizes paths, it does not prevent directory traversal sequences like "../" from escaping the intended directory. The resulting path is then opened with os.Create(), which truncates existing files if they exist. The attack requires the attacker to: (1) have a user account with PermAddOfflineDownload permission on any path, (2) control a web server to serve the malicious Content-Disposition header, (3) trigger the offline-download API endpoint POST /api/fs/add_offline_download. The attacker can write files to any location where the parent directory already exists. Patch versions 4.2.3+ apply filepath.Base() to the filename and validate it is local, along with additional containment checks.

## Affected products

- OpenListTeam OpenList <= 4.2.2

## Identifiers

- CVE-2026-75602
- GHSA-h6cj-26g5-67fv
- GO-2026-6368

## Timeline

- 2026-07-09: disclosed: Initial GitHub Advisory publication
- 2026-09-03: advisory: CVE-2026-75602 published; advisory updated
- 2026-09-03: patched: Patched in OpenList v4.2.3

## References

- [https://api.github.com/users/ILoveScratch2](https://api.github.com/users/ILoveScratch2)
- [https://github.com/ILoveScratch2](https://github.com/ILoveScratch2)
- [https://api.github.com/users/ILoveScratch2/gists%7B/gist_id%7D](https://api.github.com/users/ILoveScratch2/gists%7B/gist_id%7D)
- [https://api.github.com/users/ILoveScratch2/repos](https://api.github.com/users/ILoveScratch2/repos)
- [https://avatars.githubusercontent.com/u/161606492?v=4](https://avatars.githubusercontent.com/u/161606492?v=4)
- [https://api.github.com/users/ILoveScratch2/events%7B/privacy%7D](https://api.github.com/users/ILoveScratch2/events%7B/privacy%7D)

## Related threats

- [OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal](https://junglewise.ai/threats/cve-2026-73509-openlist-authenticated-users-can-rename-files-outside-their-base)
- [GO-2026-6113 - OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search in…](https://junglewise.ai/threats/go-2026-6113-openlist-search-metadata-count-disclosure-via-non-45d777d3)
- [GO-2026-6109 - OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API in github.com/OpenListTeam/OpenList](https://junglewise.ai/threats/cve-2026-69160-openlist-arbitrary-file-read-via-path-prefix-confusion-in-share)
- [OpenList authorization bypass and information disclosure in search API](https://junglewise.ai/threats/openlist-authorization-bypass-and-information-disclosure-in-search-api-2e0235a8)
- [GO-2026-4396 - OpenList vulnerable to Path Traversal in file copy and remove handlers in github.com/OpenListTeam/OpenList](https://junglewise.ai/threats/cve-2026-25059-openlist-vulnerable-to-path-traversal-in-file-copy-and-remove)