CVE-2026-73509

OpenList a file list program that supports multiple storage. Prior to 4.2.4, the authenticated /api/fs/batch_rename handler in server/handles/fsbatch.go authorizes only the source directory produced by user.JoinPath(req.SrcDir) and validates renameObject.NewName with checkRelativePath, but does not validate attacker-controlled renameObject.SrcName, supplied as src_name, before concatenating it with the authorized path and passing the result to fs.Rename. A user with rename permission can use traversal segments in src_name to make path normalization select a file outside the authorized directory and configured base path, resulting in cross-user file integrity loss, limited availability impact, and file-existence disclosure through success or error responses. This issue is fixed in version 4.2.4.

• CWE-22

• https://github.com/OpenListTeam/OpenList/commit/651da18da4c647d96648d4bb64462baac1c37e04
• https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4
• https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-95cv-r8x4-vh75
• https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-95cv-r8x4-vh75

Published

Aug 13, 2026

Last Modified

Aug 13, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-73501kin-openapi is a Go project for handling OpenAPI files. Prio…9.1
• CVE-2026-73502kin-openapi is a Go project for handling OpenAPI files. From…5.3
• CVE-2026-73505Oh My Posh is the most customisable and low-latency cross pl…7.8
• CVE-2026-73506Oh My Posh is the most customisable and low-latency cross pl…6.1
• CVE-2026-73507Netty is an asynchronous, event-driven network application f…7.5
• CVE-2026-73508Netty is an asynchronous, event-driven network application f…5.3
• CVE-2026-7351Race in MHTML in Google Chrome prior to 147.0.7727.138 allow…3.1
• CVE-2026-73514The address_standardizer extension for PostGIS through 3.7.0…8.8
• CVE-2026-73515PostGIS before 3.7.0beta2 contains an out-of-bounds read vul…8.1
• CVE-2026-73519WolfStack before 25.9.2 contains a hard-coded cluster-authen…9.8
• CVE-2026-7352Use after free in Media in Google Chrome on Android prior to…8.3
• CVE-2026-73522COVESA Open1722 through 0.9.2 contains a stack buffer overfl…7.5