CVE-2026-25060
- Source
- https://cve.org/CVERecord?id=CVE-2026-25060
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25060.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-25060
- Aliases
- Published
- 2026-02-02T22:26:42.421Z
- Modified
- 2026-02-25T00:36:29.225372Z
- Severity
-
- 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- OpenList Insecure TLS Default Configuration
- Details
-
OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, certificate verification is disabled by default for all storage driver communications. The TlsInsecureSkipVerify setting is default to true in the DefaultConfig() function in internal/conf/config.go. This vulnerability enables Man-in-the-Middle (MitM) attacks by disabling TLS certificate verification, allowing attackers to intercept and manipulate all storage communications. Attackers can exploit this through network-level attacks like ARP spoofing, rogue Wi-Fi access points, or compromised internal network equipment to redirect traffic to malicious endpoints. Since certificate validation is skipped, the system will unknowingly establish encrypted connections with attacker-controlled servers, enabling full decryption, data theft, and manipulation of all storage operations without triggering any security warnings. This vulnerability is fixed in 4.1.10.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25060.json", "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-599" ] }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25060.json
- https://github.com/OpenListTeam/OpenList/commit/e3c664f81d0584fbbdb86ffe6644be16259371c1
- https://github.com/OpenListTeam/OpenList/releases/tag/v4.1.10
- https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-wf93-3ghh-h389
- https://nvd.nist.gov/vuln/detail/CVE-2026-25060
Affected packages
Git / github.com/openlistteam/openlist
Affected ranges
- Type
- GIT
- Repo
- https://github.com/openlistteam/openlist
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed