CVE-2026-73509 OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal
Authenticated users can rename files outside their authorized directory via path traversal in the batch rename API, leading to data modification and information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-73509?
CVE-2026-73509 is a high-severity path traversal vulnerability in OpenListTeam OpenList, published on 13 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OpenList a file list program that supports multiple storage. Prior to 4.2.4, the authenticated /api/fs/batch_rename handler in server/handles/fsbatch.go authorizes only the source directory produced by user.JoinPath(req.SrcDir) and validates renameObject.NewName with checkRelativePath, but does not validate attacker-controlled renameObject.SrcName, supplied as src_name, before concatenating it with the authorized path and passing the result to fs.Rename. A user with rename permission can use traversal segments in src_name to make path normalization select a file outside the authorized directory and configured base path, resulting in cross-user file integrity loss, limited availability impact, and file-existence disclosure through success or error responses. This issue is fixed in version 4.2.4.
Weakness: CWE-22
Which versions are affected by CVE-2026-73509?
5 open source packages ship an affected version, including github.com/OpenListTeam/OpenList/v4, github.com/OpenListTeam/OpenList and github.com/OpenListTeam/OpenList/v3.
| Package | Affected | Fixed in |
|---|---|---|
github.com/OpenListTeam/OpenList/v4 Go | All versions | 4.2.4 |
github.com/OpenListTeam/OpenList/v4 Go | All versions | 4.2.4 |
github.com/OpenListTeam/OpenList/v4 Go | All versions | 4.2.4 |
github.com/OpenListTeam/OpenList Go | All versions | None |
github.com/OpenListTeam/OpenList/v3 Go | All versions | None |
How do I fix CVE-2026-73509?
Upgrade github.com/OpenListTeam/OpenList/v4 to 4.2.4 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-73509 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-73509 exists.
Sources
Also known as GHSA-95cv-r8x4-vh75, GO-2026-6110.