A path traversal vulnerability in OpenList’s file operation handlers allows an attacker with authenticated access to craft filenames containing ".." sequences, bypassing validated directory restrictions. This flaw enables reading, deleting, renaming, or copying files belonging to other users within the same storage mount, compromising confidentiality, integrity, and potentially availability of those files.

All OpenList releases prior to version 4.1.10 are affected. The vulnerability resides in the OpenList frontend component, specifically in the file management handlers under server/handles/fsmanage.go. The affected vendor is OpenListTeam, product OpenList. Users running any version before 4.1.10 should consider themselves at risk if they provide authenticated file manipulation capabilities.

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at the time of this analysis. The flaw is classified as CWE‑22 (Path Traversal) and requires an authenticated attacker who can invoke the file copy or remove endpoints. Once authenticated, the attacker can inject traversal sequences into filename components, thereby bypassing directory-level authorization and performing unauthorized file operations across user boundaries. The vulnerability is not currently listed in the CISA KEV catalog.