OpenList’s share creation and update endpoints validate a requested file path by simply checking if the path has the user’s BasePath as a prefix using strings.HasPrefix, without enforcing a directory separator. This allows an authenticated user with CanShare permission to submit a path that shares the same initial characters but is a sibling, such as a BasePath of "/base" and a requested path of "/base2/secret.txt". The API therefore believes the target file is within scope, enabling the attacker to create a share for the out‑of‑scope file and retrieve it through public download or list handlers, resulting in confidential data leakage.

The issue affects OpenListTeam's OpenList file list program across all deployments of the software with a version earlier than 4.2.4. The vulnerability exists in the server/handles/sharing.go component of those versions and is fixed in release 4.2.4 with proper directory separator enforcement.

The CVSS score of 6.5 classifies the flaw as moderate. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, indicating limited publicly known exploitation. Exploitation requires network access to the share creation API, valid authentication with the CanShare permission, and the ability to submit a crafted path. The attacker can read arbitrary files on the host's file system but cannot execute code or modify data, limiting impact to confidentiality breach within the application environment.