Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-75602— OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool

Quick assessment

Affected
OpenListTeam OpenList
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OpenList 是一款支持多种存储后端的文件列表管理程序。在 4.2.3 版本之前，OpenList 的离线下载功能（位于 ，使用工具 ）会接受攻击者提供的 URL，并在将内容传输到用户指定的目标存储之前，先将下载的文件字节保存到每个任务的临时目录中。 临时文件名来源于攻击者可控的 响应头。该文件名由 中的 函数解析，并传递至 中 方法里的 ，随后使用 打开文件时未进行路径边界检查。 由于 Go 语言的 函数会清理路径中的 段，拥有任意路径上“添加离线下载”权限（ ）的非管理员用户，可以遍历出 ，从而创建、截断或

CVSS 6.5 · Medium

Possible ATT&CK Techniques 2 AI

T1073 T1101

Affected Version Matrix 1

VendorProduct Version RangeStatus
OpenListTeam OpenList < 4.2.3 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-75602

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool
Source: CVE Program / CVE List V5
Vulnerability Description
OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/add_offline_download with tool: "SimpleHttp" accepts an attacker-supplied URL and saves its bytes under a per-task temporary directory before transferring them to the user's destination storage. The temporary filename comes from the attacker-controlled Content-Disposition header, is passed from parseFilenameFromContentDisposition in internal/offline_download/http/util.go to filepath.Join(task.TempDir, filename) in SimpleHttp.Run in internal/offline_download/http/client.go, and is opened with os.Create without a containment check. Because filepath.Join cleans .. segments, a non-admin user with PermAddOfflineDownload on any path can traverse out of task.TempDir and create, truncate, or overwrite any file writable by the OpenList process whose parent directory already exists. The server/handles/offline_download.go AddOfflineDownload route uses normal user authentication rather than AuthAdmin, and local-storage destinations fall through tryPutUrl in internal/offline_download/tool/add.go to the vulnerable SimpleHttp.Run path. This issue is fixed in version 4.2.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
OpenListTeam OpenList < 4.2.3 -

II. Public POCs for CVE-2026-75602

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-75602

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-75602 (1)

Vendor Advisories for CVE-2026-75602 (1)

Vendor Pages for CVE-2026-75602 (1)

IV. Related Vulnerabilities

Same product: OpenList
Same vendor: OpenListTeam
Same weakness: CWE-22

V. Comments for CVE-2026-75602

No comments yet

Leave a comment