CVE-2026-102663
- Source
- https://cve.org/CVERecord?id=CVE-2026-102663
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102663.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-102663
- Aliases
- Published
- 2026-10-12T18:49:23Z
- Modified
- 2026-10-28T02:31:04Z
- Severity
-
- 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
- Summary
- OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search
- Details
-
OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally indexed Bleve results against a restricted user's BasePath. When Bleve search is enabled and a restricted authenticated user searches the global index for content in a sibling path, the user causes a globally indexed sibling-path result to pass the prefix check. The strings.HasPrefix(node.Parent, user.BasePath) predicate allows a sibling path such as /base2 to be treated as contained by /base. Unauthorized file metadata or file-existence information can be disclosed, and the backend Total value can reveal a match even when another access check removes the individual result. This issue is fixed in version 4.2.4.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-200", "CWE-639" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102663.json" }- References
-
- https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102663.json
- https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-p6ph-3jx2-3337
- https://nvd.nist.gov/vuln/detail/CVE-2026-102663
- https://github.com/OpenListTeam/OpenList/commit/59bd3431408578f420895457554700cc9a52375a
- https://github.com/OpenListTeam/OpenList/commit/84ecda35aae2bd0020474086e6ddfd3aa2340679
Affected packages
Git / github.com/openlistteam/openlist
Affected ranges
- Type
- GIT
- Repo
- https://github.com/openlistteam/openlist
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0" }, { "fixed": "4.2.4" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "59bd3431408578f420895457554700cc9a52375a" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "84ecda35aae2bd0020474086e6ddfd3aa2340679" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v4.2.4", "range": [ { "fixed": "84ecda35aae2bd0020474086e6ddfd3aa2340679" } ], "source": "REFERENCES_TAG" } ] }