OpenList は github.com/OpenListTeam/OpenList のファイルコピーおよび削除ハンドラで Path Traversal に脆弱です

The Path Traversal vulnerability in OpenList allows an attacker to bypass intended file system restrictions. By crafting malicious requests, an attacker can manipulate the file copy and remove handlers to access files outside of the intended directory. This could lead to the exposure of sensitive configuration files, source code, or even user data. The potential impact ranges from information disclosure to complete system compromise, depending on the files accessible and the privileges of the application user. Successful exploitation could enable an attacker to gain a deeper understanding of the application's internal workings and identify further vulnerabilities.

Organizations deploying OpenList in production environments, particularly those with sensitive data stored or processed by the application, are at risk. Environments with weak file system permissions or inadequate input validation are especially vulnerable. Shared hosting environments where multiple users share the same server instance should also be considered at higher risk.

• go / server: Inspect application logs for unusual file access patterns or attempts to access files outside of the expected directories. Look for requests containing ../ sequences in file paths.

grep '../' /var/log/openlist/access.log

• generic web: Monitor web server access logs for requests targeting file copy or removal endpoints with suspicious parameters. Use a WAF to block requests containing path traversal sequences.

curl -I 'http://your-openlist-server/copy?file=../../../../etc/passwd'

• generic web: Check response headers for unexpected content types or file extensions when accessing file copy/remove endpoints. A successful path traversal might return a sensitive file with an incorrect content type.

1. 2026-02-05Disclosure

   disclosure

1. 予約済み2026-01-28
2. 公開日2026-02-05
3. EPSS 更新日2026-03-23

The primary mitigation for CVE-2026-25059 is to upgrade OpenList to version 4.1.10 or later, which includes the necessary fix. If immediate upgrading is not possible, consider implementing stricter input validation on file paths used in the copy and remove handlers. Employing a Web Application Firewall (WAF) with path traversal protection rules can also help block malicious requests. Review and restrict file system permissions for the OpenList application user to minimize the potential damage from a successful exploit.