Skip to content
Threat Feed
Subscribe

Tag

Authenticated-Bypass

1 brief RSS
high advisory

OpenList Path Traversal Vulnerability Allows Renaming Files Outside Authorized Paths

An authenticated user with rename permissions in OpenList/v4 is vulnerable to a path traversal flaw (GHSA-95cv-r8x4-vh75) in the `/api/fs/batch_rename` handler, allowing them to rename files outside their authorized base path and source directory by injecting traversal segments in the `src_name` parameter, leading to integrity violations and limited availability impact.

OpenList/v4 <= 4.2.3 path-traversal authenticated-bypass integrity-violation web-application
3t