CVE-2026-73509 OpenListTeam CVE debrief

Who should care

Defenders and administrators of OpenList installations, especially those with multiple users having rename permissions, should assess exposure and prioritize verification and remediation.

Why it matters

CVE-2026-73509 is a high-severity vulnerability in OpenList's file list program that allows authenticated users with rename permissions to manipulate file paths, potentially leading to cross-user file integrity loss and file-existence disclosure. Defenders should prioritize verifying and upgrading to OpenList version 4.2.4 or later, especially in environments where multiple users have rename permissions.

• Potential cross-user file integrity loss
• Limited availability impact due to file system manipulation
• File-existence disclosure through success or error responses

Technical summary

The authenticated /api/fs/batch_rename handler in OpenList's server/handles/fsbatch.go does not validate attacker-controlled renameObject.SrcName before concatenating it with the authorized path, allowing for path traversal and potential cross-user file integrity loss. This issue is fixed in version 4.2.4. The vulnerability has a CVSS score of 7.6 and is classified as HIGH severity. Defenders should prioritize verifying and upgrading to OpenList version 4.2.4 or later, especially in environments where multiple users have rename permissions.

Defensive priority

Defenders should prioritize verifying and upgrading to OpenList version 4.2.4 or later, especially in environments where multiple users have rename permissions.

Recommended defensive actions

• Verify and upgrade to OpenList version 4.2.4 or later
• Review and restrict rename permissions for users
• Monitor for suspicious file system activities
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 7.6 and the affected versions of OpenList. The issue is addressed in version 4.2.4. The vulnerability allows an authenticated user with rename permission to manipulate file paths, potentially leading to cross-user file integrity loss and file-existence disclosure. Defenders should verify and upgrade to OpenList version 4.2.4 or later, especially in environments where multiple users have rename permissions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.