CVE-2026-69160 OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API
Authenticated users can read files outside their assigned directory by exploiting path prefix confusion in the share creation API.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-69160?
CVE-2026-69160 is a medium-severity path traversal vulnerability in OpenListTeam OpenList, published on 18 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefix(requested_path, user.BasePath) without enforcing a directory separator boundary. An authenticated user with CanShare permission and a BasePath such as /base can submit a sibling path such as /base2/secret.txt, create a share for the out-of-scope file, and use the public share download or list handlers to read data outside the assigned directory. This issue is fixed in version 4.2.4.
Weakness: CWE-639
Which versions are affected by CVE-2026-69160?
5 open source packages ship an affected version, including github.com/OpenListTeam/OpenList/v4, github.com/OpenListTeam/OpenList and github.com/OpenListTeam/OpenList/v3.
| Package | Affected | Fixed in |
|---|---|---|
github.com/OpenListTeam/OpenList/v4 Go | All versions | 4.2.4 |
github.com/OpenListTeam/OpenList/v4 Go | All versions | 4.2.4 |
github.com/OpenListTeam/OpenList/v4 Go | All versions | 4.2.4 |
github.com/OpenListTeam/OpenList Go | All versions | None |
github.com/OpenListTeam/OpenList/v3 Go | All versions | None |
How do I fix CVE-2026-69160?
Upgrade github.com/OpenListTeam/OpenList/v4 to 4.2.4 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-69160 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-69160 exists.
Sources
Also known as GHSA-86cx-wwf4-phq4, GO-2026-6109.