CVE-2026-102663

4.3Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

4.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-200, CWE-639

Impact

Authenticated restricted users can view unauthorized file metadata or existence information from sibling directories. Exploitation requires an authenticated account and Bleve search enabled on the instance.

Root cause

The search authorization check uses a non-separator-aware strings.HasPrefix comparison, mistakenly treating sibling directory paths like /base2 as children of /base.

Affected systems

OpenList prior to 4.2.4

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Fix & remediation

Upgrade OpenList to version 4.2.4 or later. If upgrading immediately is not possible, disable Bleve search.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally indexed Bleve results against a restricted user's BasePath. When Bleve search is enabled and a restricted authenticated user searches the global index for content in a sibling path, the user causes a globally indexed sibling-path result to pass the prefix check. The strings.HasPrefix(node.Parent, user.BasePath) predicate allows a sibling path such as /base2 to be treated as contained by /base. Unauthorized file metadata or file-existence information can be disclosed, and the backend Total value can reveal a match even when another access check removes the individual result. This issue is fixed in version 4.2.4.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-102663