« Back to list

CVE-2026-25059

Status: AnalyzedHigh (8.8)—

OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, the application contains path traversal vulnerability in multiple file operation handlers in server/handles/fsmanage.go. Filename components in req.Names are directly concatenated with validated directories using stdpath.Join. This allows ".." sequences to bypass path restrictions, enabling users to access other users' files within the same storage mount and perform unauthorized actions such as deletion, renaming, or copying of files. An authenticated attacker can bypass directory-level authorisation by injecting traversal sequences into filename components, enabling unauthorised file removal and copying across user boundaries within the same storage mount. This vulnerability is fixed in 4.1.10.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

AV:N/PR:L sin UI:R → T1210 (servicios remotos con autenticación). Path traversal (CWE-22) permite leer archivos de otros usuarios (T1005), eliminar/renombrar (T1565.001) y potencialmente destruir datos (T1561.002).

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Vulnerability ScanningThreat Intelligence ProgramRestrict File and Directory PermissionsPrivileged Account ManagementRemote Data StorageNetwork Segmentation

Affected technologies (1)

Oplist — Openlist

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-25059",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-25059",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-04T15:54:29.932114Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "OpenListTeam",
          "product": "OpenList",
          "versions": [
            {
              "status": "affected",
              "version": "< 4.1.10"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-02-02T23:16:08.753",
  "references": [
    {
      "url": "https://github.com/OpenListTeam/OpenList/commit/7b78fed106382430c69ef351d43f5d09928fff14",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/OpenListTeam/OpenList/releases/tag/v4.1.10",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-qmj2-8r24-xxcq",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, the application contains path traversal vulnerability in multiple file operation handlers in server/handles/fsmanage.go. Filename components in req.Names are directly concatenated with validated directories using stdpath.Join. This allows \"..\" sequences to bypass path restrictions, enabling users to access other users' files within the same storage mount and perform unauthorized actions such as deletion, renaming, or copying of files. An authenticated attacker can bypass directory-level authorisation by injecting traversal sequences into filename components, enabling unauthorised file removal and copying across user boundaries within the same storage mount. This vulnerability is fixed in 4.1.10."
    },
    {
      "lang": "es",
      "value": "OpenList Frontend es un componente de UI para OpenList. Antes de la 4.1.10, la aplicación contiene una vulnerabilidad de salto de ruta en múltiples manejadores de operaciones de archivo en server/handles/fsmanage.go. Los componentes de nombre de archivo en req.Names se concatenan directamente con directorios validados usando stdpath.Join. Esto permite que las secuencias '..' evadan las restricciones de ruta, permitiendo a los usuarios acceder a los archivos de otros usuarios dentro del mismo montaje de almacenamiento y realizar acciones no autorizadas como la eliminación, el cambio de nombre o la copia de archivos. Un atacante autenticado puede evadir la autorización a nivel de directorio inyectando secuencias de salto de ruta en los componentes de nombre de archivo, permitiendo la eliminación y copia de archivos no autorizadas entre límites de usuario dentro del mismo montaje de almacenamiento. Esta vulnerabilidad está corregida en la 4.1.10."
    }
  ],
  "lastModified": "2026-06-17T10:24:03.673",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oplist:openlist:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8A540671-DE84-45FD-A087-21A565765CF4",
              "versionEndExcluding": "4.1.10"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}