{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/authenticated-bypass/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenList/v4 \u003c= 4.2.3"],"_cs_severities":["high"],"_cs_tags":["path-traversal","authenticated-bypass","integrity-violation","web-application"],"_cs_type":"advisory","_cs_vendors":["OpenListTeam"],"content_html":"\u003cp\u003eA high-severity path traversal vulnerability (GHSA-95cv-r8x4-vh75) has been identified in OpenList/v4, specifically affecting versions up to and including 4.2.3. The flaw resides within the \u003ccode\u003e/api/fs/batch_rename\u003c/code\u003e handler, which is responsible for batch file renaming operations. The vulnerability stems from insufficient validation of the \u003ccode\u003esrc_name\u003c/code\u003e parameter in the HTTP POST request body. While the \u003ccode\u003enew_name\u003c/code\u003e parameter is properly checked for path separators, \u003ccode\u003esrc_name\u003c/code\u003e is not, allowing an authenticated user with rename permissions to supply directory traversal segments (e.g., \u003ccode\u003e../../\u003c/code\u003e) within \u003ccode\u003esrc_name\u003c/code\u003e. This enables the attacker to manipulate the final source path to rename files located outside their designated base path and authorized \u003ccode\u003esrc_dir\u003c/code\u003e, bypassing intended access controls and affecting other users' data.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn authenticated user with file \u003ccode\u003erename\u003c/code\u003e permissions crafts an HTTP POST request targeting the \u003ccode\u003e/api/fs/batch_rename\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eThe request's JSON body specifies a \u003ccode\u003esrc_dir\u003c/code\u003e (e.g., \u003ccode\u003e/writable\u003c/code\u003e) that is within the user's legitimately authorized base path (e.g., \u003ccode\u003e/team/a\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eWithin the \u003ccode\u003erename_objects\u003c/code\u003e array in the JSON payload, the user sets the \u003ccode\u003esrc_name\u003c/code\u003e parameter to include directory traversal segments (e.g., \u003ccode\u003e../../ab/secret.txt\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eFsBatchRename\u003c/code\u003e handler processes the request but fails to adequately validate the \u003ccode\u003esrc_name\u003c/code\u003e parameter for path traversal sequences.\u003c/li\u003e\n\u003cli\u003eOpenList concatenates the provided \u003ccode\u003esrc_dir\u003c/code\u003e and the attacker-controlled \u003ccode\u003esrc_name\u003c/code\u003e to construct a full source path (e.g., \u003ccode\u003e/team/a/writable/../../ab/secret.txt\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eLower-level filesystem path normalization functions resolve these traversal segments, resulting in a final, absolute source path (e.g., \u003ccode\u003e/team/ab/secret.txt\u003c/code\u003e) that unexpectedly escapes the user's authorized directory.\u003c/li\u003e\n\u003cli\u003eThe application proceeds to rename the file located at this normalized, out-of-scope path (\u003ccode\u003e/team/ab/secret.txt\u003c/code\u003e) to the specified \u003ccode\u003enew_name\u003c/code\u003e (e.g., \u003ccode\u003erenamed.txt\u003c/code\u003e), thereby performing an unauthorized file modification.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability allows an authenticated user to violate the integrity of other users' files by renaming them outside their authorized scope. In a multi-user OpenList deployment, a user confined to a specific base path (e.g., \u003ccode\u003e/team/a\u003c/code\u003e) can rename sibling files (e.g., \u003ccode\u003e/team/ab/secret.txt\u003c/code\u003e) belonging to other users. This can lead to limited availability, as crucial files may be moved from their expected locations, disrupting operations. Furthermore, by observing success or error responses from such rename attempts, an attacker could potentially confirm the existence of guessed files outside their base path, aiding in reconnaissance.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize applying the security patch for OpenList/v4 to address GHSA-95cv-r8x4-vh75 immediately. Implement robust validation for the \u003ccode\u003erenameObject.SrcName\u003c/code\u003e parameter within the \u003ccode\u003e/api/fs/batch_rename\u003c/code\u003e handler by applying the same \u003ccode\u003echeckRelativePath\u003c/code\u003e constraints currently used for \u003ccode\u003erenameObject.NewName\u003c/code\u003e. Alternatively, ensure that source objects are derived exclusively from a trusted directory listing of \u003ccode\u003ereqPath\u003c/code\u003e.\u003c/p\u003e\n","date_modified":"2026-07-24T22:34:55Z","date_published":"2026-07-24T22:34:55Z","id":"https://feed.craftedsignal.io/briefs/2026-07-openlist-path-traversal/","summary":"An authenticated user with rename permissions in OpenList/v4 is vulnerable to a path traversal flaw (GHSA-95cv-r8x4-vh75) in the `/api/fs/batch_rename` handler, allowing them to rename files outside their authorized base path and source directory by injecting traversal segments in the `src_name` parameter, leading to integrity violations and limited availability impact.","title":"OpenList Path Traversal Vulnerability Allows Renaming Files Outside Authorized Paths","url":"https://feed.craftedsignal.io/briefs/2026-07-openlist-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Authenticated-Bypass","version":"https://jsonfeed.org/version/1.1"}