Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-102663— OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search

Quick assessment

Affected
OpenListTeam OpenList
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OpenList 是一款支持多种存储后端的文件列表程序。在 4.2.4 版本之前，OpenList 的搜索 API 在处理全局索引的 Bleve 搜索结果时，对用户权限验证存在缺陷：它使用了不感知分隔符的 进行路径包含性检查，以判断受限用户是否有权访问其 下的内容。 当启用 Bleve 搜索功能时，如果经过身份验证的受限用户在当前用户的 的 sibling 路径（即兄弟路径）中搜索内容，攻击者可以使全局索引中返回的该 sibling 路径的结果通过前缀检查。具体来说，谓词 会错误地将诸如 这样的 sibling 路

CVSS 4.3 · Medium

Possible ATT&CK Techniques 1 AI

T1530 · Data from Cloud Storage

Affected Version Matrix 1

VendorProduct Version RangeStatus
OpenListTeam OpenList < 4.2.4 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-102663

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search
Source: CVE Program / CVE List V5
Vulnerability Description
OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally indexed Bleve results against a restricted user's BasePath. When Bleve search is enabled and a restricted authenticated user searches the global index for content in a sibling path, the user causes a globally indexed sibling-path result to pass the prefix check. The strings.HasPrefix(node.Parent, user.BasePath) predicate allows a sibling path such as /base2 to be treated as contained by /base. Unauthorized file metadata or file-existence information can be disclosed, and the backend Total value can reveal a match even when another access check removes the individual result. This issue is fixed in version 4.2.4.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
OpenListTeam OpenList < 4.2.4 -

II. Public POCs for CVE-2026-102663

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-102663

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-102663 (2)

Vendor Advisories for CVE-2026-102663 (1)

Vendor Pages for CVE-2026-102663 (1)

IV. Related Vulnerabilities

Same product: OpenList
Same vendor: OpenListTeam
Same weakness: CWE-200

V. Comments for CVE-2026-102663

No comments yet

Leave a comment