CVE-2026-69160: OpenList Path Traversal Vulnerability

CVE-2026-69160 Overview

CVE-2026-69160 is an authorization bypass vulnerability in OpenList, a file list program that supports multiple storage backends. The flaw exists in the share creation and update logic within server/handles/sharing.go. The code uses strings.HasPrefix(requested_path, user.BasePath) without enforcing a directory separator boundary. An authenticated user holding the CanShare permission with a BasePath such as /base can submit a sibling path like /base2/secret.txt. The user then creates a share for the out-of-scope file and reads its contents through the public share download or list handlers. Versions prior to 4.2.4 are affected. The issue is tracked under CWE-639 (Authorization Bypass Through User-Controlled Key).

Critical Impact
Authenticated users with sharing privileges can read files outside their assigned directory scope, breaking multi-tenant isolation and exposing confidential data.

Affected Products

OpenList versions prior to 4.2.4
OpenList server component server/handles/sharing.go
Deployments granting the CanShare permission to non-admin users

Discovery Timeline

2026-08-18 - CVE-2026-69160 published to NVD
2026-08-18 - Last updated in NVD database
Fix released - OpenList v4.2.4 addresses the issue

Technical Details for CVE-2026-69160

Vulnerability Analysis

OpenList validates share paths against the creator's BasePath using a naive string prefix check. The check strings.HasPrefix(requested_path, user.BasePath) returns true whenever the requested path begins with the same characters as BasePath, regardless of directory structure. A BasePath value of /base matches both /base/file.txt and /base2/secret.txt because no trailing separator is enforced. This lets an authenticated user with the CanShare permission designate arbitrary sibling directories as shareable content. Once a share is created, its download and list handlers expose the target file through public endpoints without further authorization checks.

Root Cause

The root cause is missing separator boundary enforcement during path containment validation. The vulnerable comparison treats BasePath as a text prefix rather than a filesystem hierarchy prefix. The upstream patch introduces an utils.IsSubPath helper and revalidates each shared file against the creator's current BasePath at share resolution time. The patch also handles cases where an administrator later reduces a user's BasePath, preventing stale shares from returning out-of-scope files.

Attack Vector

Exploitation requires an authenticated account with the CanShare permission and network access to the OpenList web interface. The attacker submits a share creation request that references a path outside their BasePath but sharing the same string prefix. The server accepts the request, generates a public share token, and serves the file through the anonymous share endpoints.

// Security patch in internal/op/sharing.go - enforce base path boundaries
// Source: https://github.com/OpenListTeam/OpenList/commit/59bd3431408578f420895457554700cc9a52375a

if len(sharing.Files) == 0 {
    return "", errors.New("cannot get actual path of an invalid sharing")
}
// Re-validate that the shared paths are still within the creator's current
// BasePath. This prevents access to files that fell out-of-scope after the
// creator's BasePath was changed by an admin.
if sharing.Creator != nil && !sharing.Creator.IsAdmin() {
    for _, f := range sharing.Files {
        if !utils.IsSubPath(sharing.Creator.BasePath, f) {
            return "", errors.Errorf("sharing path [%s] is outside the creator's base path", f)
        }
    }
}
if len(sharing.Files) == 1 {
    return stdpath.Join(sharing.Files[0], path), nil
}

The patch replaces prefix comparison with utils.IsSubPath, which enforces separator boundaries and rejects sibling directories that share a textual prefix.

Detection Methods for CVE-2026-69160

Indicators of Compromise

Share creation requests where the target path lies outside the creator's assigned BasePath value.
Access logs showing public share download or list handler activity for files not previously exposed to that user.
Audit records where the Files array of a share contains sibling directories matching the BasePath prefix but not its hierarchy.

Detection Strategies

Parse OpenList application logs for share creation events and correlate the requested file paths against the creator's BasePath using a separator-aware comparison.
Alert on non-admin accounts creating shares whose target path segments differ from their BasePath after the first separator boundary.
Review OpenList database records for existing shares that would fail an IsSubPath check against the current creator BasePath.

Monitoring Recommendations

Enable verbose audit logging for the sharing subsystem and forward events to a centralized log store.
Monitor anonymous share endpoint traffic for spikes tied to newly created share tokens.
Track privilege assignments for the CanShare permission and review any account granted this capability against expected roles.

How to Mitigate CVE-2026-69160

Immediate Actions Required

Upgrade OpenList to version 4.2.4 or later, which includes the boundary enforcement patch.
Audit existing share records and delete any share whose target path falls outside the creator's current BasePath.
Review users holding the CanShare permission and revoke it where not required.

Patch Information

The fix is committed in 59bd3431 and shipped in OpenList v4.2.4. It replaces the strings.HasPrefix check with utils.IsSubPath and revalidates share paths at resolution time. Details are published in GitHub Security Advisory GHSA-86cx-wwf4-phq4.

Workarounds

Temporarily remove the CanShare permission from all non-admin accounts until the upgrade is applied.
Restructure directory naming so no two BasePath values share a textual prefix, for example replacing /base and /base2 with /tenant-a and /tenant-b.
Place OpenList behind a reverse proxy that blocks share creation endpoints for untrusted users during patch rollout.

bash

# Verify the running OpenList version and upgrade to the patched release
openlist version

# Pull the fixed release binary or container image
docker pull openlistteam/openlist:v4.2.4
docker stop openlist && docker rm openlist
docker run -d --name openlist -p 5244:5244 -v /opt/openlist:/opt/openlist/data openlistteam/openlist:v4.2.4