An authenticated attacker can supply a malicious Content-Disposition header in a request to load an offline‑download using the SimpleHttp tool. The filename extracted from that header is joined with a temporary task directory and created directly without checking that the resulting path remains inside the task’s intended directory. Because the path separator logic collapses ".." segments, the attacker can walk out of the temporary directory and write, truncate, or overwrite any file that the OpenList process can write, including configuration files or other sensitive assets. This flaw permits data manipulation or persistence of attacker‑supplied data on the filesystem and could be leveraged in chained attacks if the target system can execute written files or if the attacker gains control of file‑based configuration. The vulnerability is limited to users who possess the PermAddOfflineDownload permission and relies on normal application authentication, not administrative privileges.

Affected systems are versions of the OpenList file‑list program released before 4.2.3 by the OpenListTeam. All earlier releases that expose the POST /api/fs/add_offline_download endpoint and use the vulnerable SimpleHttp tool are susceptible. The flaw is fixed in version 4.2.3 and later, so any installation still on or earlier than 4.2.2 must be upgraded.

Risk and exploitability are moderate: the CVSS score is 6.5, indicating significant impact but not catastrophic. No EPSS score is available, so the likelihood of exploitation is unknown without additional data. The vulnerability is not listed in the CISA KEV catalog. Attackers need valid credentials with the AddOfflineDownload permission, and the attack vector is server‑side, authenticated; local filesystem writes can lead to further compromise if additional privileges or code execution mechanisms exist.