OpenList 存在于 github.com/OpenListTeam/OpenList 的文件复制和删除处理程序中的路径遍历漏洞

攻击者可以利用此路径遍历漏洞读取或修改服务器上的任意文件，包括配置文件、源代码和用户数据。这可能导致敏感信息泄露、恶意代码注入或系统完整性受损。如果攻击者能够访问数据库凭据，他们可能能够访问整个数据库。由于OpenList可能被用于存储敏感数据，因此该漏洞的潜在影响非常严重。攻击者可能通过构造恶意的文件路径来触发此漏洞，例如，通过上传包含特殊字符的文件来绕过安全检查。

Organizations deploying OpenList in production environments, particularly those with sensitive data stored or processed by the application, are at risk. Environments with weak file system permissions or inadequate input validation are especially vulnerable. Shared hosting environments where multiple users share the same server instance should also be considered at higher risk.

• go / server: Inspect application logs for unusual file access patterns or attempts to access files outside of the expected directories. Look for requests containing ../ sequences in file paths.

grep '../' /var/log/openlist/access.log

• generic web: Monitor web server access logs for requests targeting file copy or removal endpoints with suspicious parameters. Use a WAF to block requests containing path traversal sequences.

curl -I 'http://your-openlist-server/copy?file=../../../../etc/passwd'

• generic web: Check response headers for unexpected content types or file extensions when accessing file copy/remove endpoints. A successful path traversal might return a sensitive file with an incorrect content type.

1. 2026-02-05Disclosure

   disclosure

1. 已保留2026-01-28
2. 发布日期2026-02-05
3. EPSS 更新日期2026-03-23

最有效的缓解措施是立即升级至OpenList 4.1.10版本。如果无法立即升级，可以考虑使用Web应用防火墙（WAF）来过滤恶意请求，并限制对文件复制和删除处理程序的访问。此外，应审查OpenList的配置，确保文件存储目录的权限设置正确，并禁用不必要的目录访问。在升级后，请验证文件复制和删除功能是否正常工作，并检查系统日志中是否有异常活动。