01 Record

CVE-2026-73509

OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal

HighPUBLISHEDCNA: GitHub_M

Base score7.6 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

02 Description

OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal

Published: 2026-08-13 14:31Z1 DAY AGO
Last updated: 2026-08-13 15:20Z1 DAY AGO
Reserved: 2026-08-12
Assigning CNA: GitHub_M
Record state: PUBLISHED
Severity: High (CVSS 7.6)
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Weaknesses: CWE-22
SSVC decision: ExploitationpocAutomatablenoTechnical Impactpartial
Data version: 5.2
Document digest: 852f5cf836aba6f4e9a7999f86f97de3b9ac9c7b0f7da1e4db3f352c87da158d

VendorProductVersionsPlatforms

OpenListTeamOpenList< 4.2.4—