CVE-2026-102663 in OpenList
Summary
by MITRE • 10/12/2026
OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally indexed Bleve results against a restricted user's BasePath. When Bleve search is enabled and a restricted authenticated user searches the global index for content in a sibling path, the user causes a globally indexed sibling-path result to pass the prefix check. The strings.HasPrefix(node.Parent, user.BasePath) predicate allows a sibling path such as /base2 to be treated as contained by /base. Unauthorized file metadata or file-existence information can be disclosed, and the backend Total value can reveal a match even when another access check removes the individual result. This issue is fixed in version 4.2.4.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in OpenList prior to version 4.2.4 represents a critical authorization bypass rooted in improper string comparison logic within its search API implementation. The application utilizes Bleve for global indexing, allowing users to search across multiple storage backends. To enforce security boundaries, the system attempts to restrict authenticated users with limited permissions so they can only access files and directories contained within their designated BasePath. However, the mechanism used to validate whether a retrieved file belongs to the user's authorized scope relies on a flawed prefix check using Go’s strings.HasPrefix function without accounting for path separators. This technical flaw allows an attacker to bypass directory isolation controls by exploiting the lack of delimiter awareness in the string matching algorithm.
From a technical perspective, the core issue lies in how the authorization predicate evaluates path containment. The code checks if node.Parent starts with user.BasePath using strings.HasPrefix(node.Parent, user.BasePath). In standard file system semantics, paths are hierarchical and separated by delimiters such as slashes. A correct implementation must ensure that /base2 is not considered a child of /base because they represent distinct directories at the same level in the hierarchy. By failing to append or check for a separator after the BasePath string, the validation logic incorrectly treats sibling paths as subsets of the authorized path. For instance, if a user's allowed base path is set to /base, the prefix check will return true for any file located under /base2 because the string /base2 indeed starts with the characters /base. This logical error effectively nullifies the intended access control restrictions imposed by the BasePath configuration.
The operational impact of this vulnerability allows unauthorized users to disclose sensitive information that should remain isolated within their specific storage scope. When a restricted user performs a search against the global index, they can retrieve metadata and existence information for files located in sibling directories outside their permitted area. Even if subsequent access checks might filter out individual file contents or prevent direct downloads of those files, the mere act of confirming their existence through search results constitutes an information disclosure vulnerability. Furthermore, backend aggregate values such as Total counts may reveal matches that indicate the presence of restricted data, providing attackers with reconnaissance capabilities about the structure and content of other users' storage areas. This leakage can facilitate further attacks by revealing file names, directory structures, or potential targets for more sophisticated exploitation attempts.
This flaw aligns closely with CWE-284 Improper Access Control, specifically where authorization checks fail to properly restrict access to resources based on user roles or permissions. Additionally, the technique of using search results to infer the existence and location of restricted files corresponds to ATT&CK tactic TA0006 Discovery, particularly subtechniques related to file and directory discovery. The vulnerability highlights a common pitfall in path validation where developers assume string prefix matching is sufficient for hierarchical resource isolation without considering delimiter boundaries.
To mitigate this issue, organizations running OpenList must upgrade immediately to version 4.2.4 or later, which contains the fix for this authorization bypass. For environments that cannot be upgraded instantly, administrators should review user configurations and ensure that BasePath values are structured in a way that minimizes ambiguity, although relying on path structure alone is not a secure defense against prefix-based attacks. Implementing additional validation layers at the application level to verify full path equality or using robust path resolution libraries that normalize and validate directory hierarchies can provide supplementary protection. Regular security audits of authentication and authorization logic are recommended to detect similar flaws in other components of the system, ensuring that all resource access controls strictly adhere to least privilege principles and correctly handle hierarchical path separators.