Executive brief
OpenList, a file storage and management application, contains a security flaw in its search functionality. An authenticated user can bypass directory restrictions to view file names and metadata in folders they are not authorized to access. This could lead to the exposure of sensitive internal documents or infrastructure details.
Technical details
The vulnerability exists in the search handler (server/handles/search.go) due to an insecure path prefix validation using 'strings.HasPrefix'. Because the check is not path-separator aware, a user restricted to '/base' can access a sibling directory like '/base2'. Additionally, the Bleve search backend (internal/search/bleve/search.go) ignores path boundaries and returns a global 'Total' count. This allows attackers to perform blind data enumeration by observing search result counts for keywords even if file content is otherwise restricted. The issue is fixed in version 4.2.4 by implementing separator-aware path containment and backend-level filtering.
Affected products
- OpenListTeam OpenList <= 4.2.3
Timeline
- 2026-07-23: disclosed
- 2026-07-24: patched: Fixed in version 4.2.4
- 2026-07-24: advisory