OpenList’s batch rename endpoint allows an authenticated user to supply a traversal-containing source name that is concatenated with an authorized directory path and renamed without validating the source name. This flaw can move files outside the user’s base directory, causing cross‑ file integrity loss, limited availability impacts, and file existence disclosure via success or error responses. The weakness is a path traversal vulnerability (CWE‑22).

The vulnerability affects OpenListTeam’s OpenList product in all releases before 4.2.4. Version 4.2.4 and later contain a fix that validates and sanitizes the src_name parameter.

The CVSS score of 7.6 indicates moderate‑to‑high severity. The EPSS is not available, and the issue is not listed in CISA’s KEV catalog. Exploitation requires an authenticated user with rename permission to submit a specially crafted src_name value to the /api/fs/batch_rename endpoint, after which the server will rename files outside the intended directory hierarchy. The attack vector is internal but relies on legitimate credentials, making detection via authentication logs possible.