CVE-2026-25059Disclosure(oplist / openlist)

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch oplist openlist systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, the application contains path traversal vulnerability in multiple file operation handlers in server/handles/fsmanage.go. Filename components in req.Names are directly concatenated with validated directories using stdpath.Join. This allows ".." sequences to bypass path restrictions, enabling users to access other users' files within the same storage mount and perform unauthorized actions such as deletion, renaming, or copying of files. An authenticated attacker can bypass directory-level authorisation by injecting traversal sequences into filename components, enabling unauthorised file removal and copying across user boundaries within the same storage mount. This vulnerability is fixed in 4.1.10.

oplist CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://github.com/OpenListTeam/OpenList/commit/7b78fed106382430c69ef351d43f5d09928fff14

Exploit / PoC references

https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-qmj2-8r24-xxcq

Other references

https://github.com/OpenListTeam/OpenList/releases/tag/v4.1.10

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

openlist

Threat summary

Patch or workaround signal is available
4 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 4 signals
Disclosure: 3 classified signals
Peaked 1d ago at 2 mentions (2026-02-03); latest day: 1
4 total mentions across 3 days

Affected systems

Vendors

oplist

Products

openlist

Deep dive

Activity timeline4 mentions / 3d

Signal classification2 categories

Disclosure

375.0%

Patch

125.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-02	1	Disclosure1
2026-02-03	2	Disclosure1Patch1
2026-02-04	1	Disclosure1

Full discourse4 posts

PulsePatch.io@pulsepatchio248d
Disclosure
OpenList is affected by a path traversal vulnerability (CVE-2026-25059) in file copy/remove handlers. This could allow unauthorized file manipulation. #OpenList #PathTraversal #infosec https://www.pulsepatch.io/posts/cve-2026-25059-openlist-path-traversal
Post summary
A path traversal flaw (CVE-2026-25059) has been disclosed in OpenList’s file copy/remove handlers, potentially enabling unauthorized file manipulation.
0000068
1 followersView on X
CVEFind.com@CveFindCom249d
Patch
[CVE-2026-25059: HIGH] OpenList Frontend had a path traversal vulnerability in file operations prior to version 4.1.10, allowing unauthorized access and actions. Update to the latest version for a fix.#cve,CVE-2026-25059,#cybersecurity https://cvefind.com/CVE-2026-25059
Post summary
The post highlights a path traversal flaw in OpenList Frontend that allows unauthorized file access and stresses updating to the latest version to remediate the issue.
0000048
583 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds249d
Disclosure
CVE-2026-25059 Path Traversal in OpenList Frontend Below 4.1.10 Enabling... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-25059 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
The tweet announces a path traversal vulnerability in OpenList Frontend versions under 4.1.10, providing a link for additional details.
0000051
4.0K followersView on X
CVE@CVEnew249d
Disclosure
CVE-2026-25059 OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, the application contains path traversal vulnerability in multiple file operation handlers in server… https://www.cve.org/CVERecord?id=CVE-2026-25059
Post summary
The post announces a path traversal vulnerability (CVE‑2026‑25059) in OpenList Frontend affecting versions prior to 4.1.10, without mentioning exploitation, PoC, or patches.
00000122
56.5K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	oplist	openlist	-	-	-

Explore more

Back to dashboard oplist CVEs openlist vulnerabilities

What researchers are saying

CVE-2026-25059

PulsePatch.io@pulsepatchioDisclosure

A path traversal flaw (CVE-2026-25059) has been disclosed in OpenList’s file copy/remove handlers, potentially enabling unauthorized file manipulation.

CVEFind.com@CveFindComPatch

The post highlights a path traversal flaw in OpenList Frontend that allows unauthorized file access and stresses updating to the latest version to remediate the issue.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The tweet announces a path traversal vulnerability in OpenList Frontend versions under 4.1.10, providing a link for additional details.

CVE@CVEnewDisclosure

The post announces a path traversal vulnerability (CVE‑2026‑25059) in OpenList Frontend affecting versions prior to 4.1.10, without mentioning exploitation, PoC, or patches.