OpenList arbitrary file read via path prefix confusion in sharing API

Executive brief

OpenList, a file-sharing application, contains a vulnerability that allows users to access files they are not authorized to see. By exploiting a flaw in how the system checks folder permissions, a logged-in user can create sharing links for sensitive files belonging to other users or the system itself. This could lead to the unauthorized exposure of private documents and internal application data.

Technical details

An authorization bypass exists in OpenList's share creation API (server/handles/sharing.go) due to a path prefix confusion vulnerability. The application uses 'strings.HasPrefix' to validate if a requested file path is within a user's 'BasePath', but fails to account for directory separators. For example, a user restricted to '/base' can successfully request '/base2/secret.txt' because '/base' is a string prefix of '/base2'. An authenticated attacker can exploit this to create public share links for unauthorized files, which can then be accessed via the public download endpoints. The issue is fixed in version 4.2.4 by implementing separator-aware path validation.

Affected products

• OpenListTeam OpenList <= 4.2.3

Timeline

• 2026-07-23: disclosed
• 2026-07-24: advisory: GitHub Advisory published
• 2026-07-24: patched: Version 4.2.4 released

References

• https://api.github.com/users/cns1rius
• https://github.com/cns1rius
• https://api.github.com/users/cns1rius/gists%7B/gist_id%7D
• https://api.github.com/users/cns1rius/repos
• https://avatars.githubusercontent.com/u/73370907?v=4
• https://api.github.com/users/cns1rius/events%7B/privacy%7D