Executive brief
OpenList, a file management and sharing platform, contains a vulnerability where authenticated users can rename files they should not have access to. By using special characters in file names during a batch rename operation, a user can escape their assigned folder and modify files belonging to other users or the system. This could lead to data corruption, unauthorized reorganization of files, or service disruption by moving critical files to unknown locations.
Technical details
A path traversal vulnerability exists in the `/api/fs/batch_rename` handler of OpenList. While the application validates the destination name (`new_name`) and the source directory (`src_dir`), it fails to sanitize the `src_name` parameter within the batch rename loop. An authenticated attacker with rename permissions can provide traversal sequences (e.g., `../../`) in `src_name`. The application concatenates the authorized `src_dir` with the malicious `src_name` and passes it to the filesystem layer, which normalizes the path, allowing the attacker to rename files outside their restricted base path. This issue is addressed in version 4.2.4 by implementing relative path checks on the source name.
Affected products
- OpenListTeam OpenList <= 4.2.3
Timeline
- 2026-07-23: advisory: Initial GitHub Advisory publication
- 2026-07-24: patched: Version 4.2.4 released