CVE-2026-102663 OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search
A restricted user can leak file metadata and existence information from sibling paths due to a flawed path containment check in the search API.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-102663?
CVE-2026-102663 is a medium-severity vulnerability in OpenListTeam OpenList, published on 12 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally indexed Bleve results against a restricted user's BasePath. When Bleve search is enabled and a restricted authenticated user searches the global index for content in a sibling path, the user causes a globally indexed sibling-path result to pass the prefix check. The strings.HasPrefix(node.Parent, user.BasePath) predicate allows a sibling path such as /base2 to be treated as contained by /base. Unauthorized file metadata or file-existence information can be disclosed, and the backend Total value can reveal a match even when another access check removes the individual result. This issue is fixed in version 4.2.4.
Which versions are affected by CVE-2026-102663?
5 open source packages ship an affected version, including github.com/OpenListTeam/OpenList/v4, github.com/OpenListTeam/OpenList and github.com/OpenListTeam/OpenList/v3.
| Package | Affected | Fixed in |
|---|---|---|
github.com/OpenListTeam/OpenList/v4 Go | All versions | 4.2.4 |
github.com/OpenListTeam/OpenList/v4 Go | All versions | 4.2.4 |
github.com/OpenListTeam/OpenList/v4 Go | All versions | 4.2.4 |
github.com/OpenListTeam/OpenList Go | All versions | None |
github.com/OpenListTeam/OpenList/v3 Go | All versions | None |
How do I fix CVE-2026-102663?
Upgrade github.com/OpenListTeam/OpenList/v4 to 4.2.4 or later.
Is CVE-2026-102663 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-102663 exists.
Sources
Also known as GHSA-p6ph-3jx2-3337, GO-2026-6113.