CVE-2026-75602 OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool
Authenticated users can exploit path traversal in the offline-download tool to overwrite arbitrary files, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-75602?
CVE-2026-75602 is a medium-severity path traversal vulnerability in OpenListTeam OpenList, published on 3 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/add_offline_download with tool: "SimpleHttp" accepts an attacker-supplied URL and saves its bytes under a per-task temporary directory before transferring them to the user's destination storage. The temporary filename comes from the attacker-controlled Content-Disposition header, is passed from parseFilenameFromContentDisposition in internal/offline_download/http/util.go to filepath.Join(task.TempDir, filename) in SimpleHttp.Run in internal/offline_download/http/client.go, and is opened with os.Create without a containment check. Because filepath.Join cleans .. segments, a non-admin user with PermAddOfflineDownload on any path can traverse out of task.TempDir and create, truncate, or overwrite any file writable by the OpenList process whose parent directory already exists. The server/handles/offline_download.go AddOfflineDownload route uses normal user authentication rather than AuthAdmin, and local-storage destinations fall through tryPutUrl in internal/offline_download/tool/add.go to the vulnerable SimpleHttp.Run path. This issue is fixed in version 4.2.3.
Which versions are affected by CVE-2026-75602?
5 open source packages ship an affected version, including github.com/OpenListTeam/OpenList, github.com/OpenListTeam/OpenList/v3 and github.com/OpenListTeam/OpenList/v4.
| Package | Affected | Fixed in |
|---|---|---|
github.com/OpenListTeam/OpenList Go | All versions | None |
github.com/OpenListTeam/OpenList Go | All versions | 4.2.3 |
github.com/OpenListTeam/OpenList Go | All versions | 4.2.3 |
github.com/OpenListTeam/OpenList/v3 Go | All versions | None |
github.com/OpenListTeam/OpenList/v4 Go | All versions | 4.2.3 |
How do I fix CVE-2026-75602?
Upgrade github.com/OpenListTeam/OpenList to 4.2.3 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-75602 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-75602 exists.
Sources
Also known as GHSA-h6cj-26g5-67fv, GO-2026-6368.