GO-2026-6368

vendorUSosv

OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool in github.com/OpenListTeam/OpenList

view advisory published 2026-09-10Licence: per source

OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool in github.com/OpenListTeam/OpenList

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-75602US	—	0.69% (53rd)	—	2026-09-03
OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/add_offline_download with tool: "SimpleHttp" accept…

references

External citations — patches, advisories, analysis.

https://github.com/OpenListTeam/OpenList/commit/9cc5dd969b9833c8cb4e14c338c3571dfdbe2108FIX
https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.3WEB
https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-h6cj-26g5-67fvADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan