Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/OpenListTeam/OpenList/v4

6 known vulnerabilities (3 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
6 · 3 high, 3 medium
Registry
pkg.go.dev

Advisories 6

  • CVE-2026-102663Medium 4.3

    OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search

    Affected: fixed in 4.2.4.

  • CVE-2026-75602Medium 6.5

    OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool

    Affected: fixed in 4.2.3.

  • CVE-2026-69160Medium 6.5

    OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API

    Affected: fixed in 4.2.4.

  • OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal

    Affected: fixed in 4.2.4.

  • OpenList Insecure TLS Default Configuration

    Affected: fixed in 4.1.10.

  • OpenList affected by Path Traversal in file copy and remove handlers

    Affected: fixed in 4.1.10.