CVE-2026-25059

This is a flaw in OpenList’s file-management functions that can let one logged-in user reach files outside the folder they are meant to use. It is like giving someone a key to one office but allowing them to use that key to enter neighboring offices and move or destroy documents.

This matters to you if you run OpenList and allow more than one user to manage files in the same storage mount. It is only a risk if an attacker already has a login.

No confirmed active exploitation is reported, and it is not listed in CISA’s catalog of vulnerabilities known to be exploited. Treat this as an amber-priority update: schedule the upgrade promptly, especially where multiple users share storage.

Confirm the deployed OpenList version and identify storage mounts shared by separate users or permission groups. Upgrade to OpenList 4.1.10 or later; for Go module users, target github.com/OpenListTeam/OpenList/v4 version 4.1.10 or newer and test file copy, rename, and removal workflows after deployment.

If upgrading is delayed, restrict untrusted accounts from shared mounts or remove their ability to perform file copy, rename, and deletion operations where practical. Review logs and storage audit records for unexpected cross-directory copy, rename, or deletion activity. CISA has not assigned a KEV remediation due date for this CVE.

CVE-2026-25059 is rated CVSS 8.8 (High): network reachable, low attack complexity, authenticated attacker required, no user interaction, with high confidentiality, integrity, and availability impact. The issue is CWE-22 path traversal in file-operation handlers: attacker-controlled filename components containing .. can bypass validated directory restrictions and operate on another user’s files within the same storage mount. It is not in CISA KEV, no public exploit code is recorded, and EPSS is 0.6% (48th percentile) with a flat trend; press attention is rising but does not establish exploitation.