CVE-2026-25059: 
NixOS vulnerability analysis and mitigation

CVE-2026-25059 is a path traversal vulnerability (CWE-22) in OpenList, an open-source file management application written in Go. It affects all versions of OpenList before 4.1.10 and was published on January 31, 2026, by the XlabAI Team of Tencent Xuanwu Lab via the Atuin Automated Vulnerability Discovery Engine. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, OpenList Security Advisory).

The root cause is improper pathname validation (CWE-22) in multiple file operation handlers within server/handles/fsmanage.go. Specifically, filename components from req.Names are directly concatenated with validated directory paths using stdpath.Join without sanitizing .. sequences, allowing traversal outside the user's authorized base directory. The vulnerable functions are FsRemove (e.g., fs.Remove(c, stdpath.Join(reqDir, name))) and FsCopy (e.g., fs.Get(c.Request.Context(), stdpath.Join(dstDir, name), ...)). An authenticated attacker with basic file operation permissions (remove/copy) in a multi-user shared storage environment can inject ../ sequences into the Names field to access files belonging to other users on the same storage mount, provided they know or can guess the target file's path (GitHub Advisory, Patch Commit).

A successful exploit allows an authenticated attacker to read, copy, and exfiltrate files from other users' directories within the same storage mount, as well as delete files belonging to other users — resulting in high confidentiality, integrity, and availability impact. The vulnerability is scoped to the shared storage mount, meaning lateral movement is constrained to co-tenants on the same mount rather than the broader host system. In multi-tenant deployments, this could expose sensitive administrative files or user data to unauthorized parties (GitHub Advisory, OpenList Security Advisory).

A proof-of-concept (PoC) exploit, including a demonstration video, is publicly available in the GitHub security advisory. There is no current evidence of active in-the-wild exploitation. The EPSS score is approximately 0.034% (0.000210 per Feedly), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported (GitHub Advisory, OpenList Security Advisory).

1. Reconnaissance: Identify an OpenList instance running a version prior to 4.1.10 in a multi-user shared storage environment. Confirm that the target deployment uses a shared local storage mount (e.g., /local) with multiple user base paths.
2. Authentication: Log in with a valid non-guest user account (e.g., as user "alice" with base path /local/alice) that has file copy or remove permissions.
3. Identify target file: Determine or guess the name and path of a target file outside your authorized directory (e.g., /local/adminsecret.txt belonging to an admin).
4. Craft malicious request: Send an API request to the FsCopy or FsRemove endpoint, injecting a path traversal sequence into the Names field. For example, set Names to ["../adminsecret.txt"] and SrcDir to /local/alice, causing the resolved path to become /local/adminsecret.txt.
5. Exfiltrate or destroy data: For FsCopy, the file is copied to a destination directory accessible to the attacker, enabling exfiltration. For FsRemove, the file is deleted from the victim's directory, causing data loss (GitHub Advisory, OpenList Security Advisory).

• Network: Unusual API requests to OpenList file operation endpoints (/api/fs/remove, /api/fs/copy) containing .. sequences or encoded traversal patterns (e.g., %2e%2e) in the Names parameter.
• Logs: OpenList access logs showing file operation requests where Names values resolve to paths outside the authenticated user's base directory; log entries referencing files in other users' directories or root-level storage paths.
• File System: Unexpected files appearing in a user's directory that belong to another user's namespace; missing files from admin or other user directories without corresponding authorized deletion activity.
• Process/Application: OpenList warning log entries (e.g., FsRemove: invalid item skipped) triggered by traversal attempts that were partially blocked, indicating probing activity (GitHub Advisory).

The vulnerability is patched in OpenList version 4.1.10, released January 31, 2026. The fix introduces user.JoinPath() validation on each entry in req.Names before path concatenation in FsRemove, FsCopy, and FsMove handlers, ensuring traversal sequences are rejected with a 403 error. Administrators should upgrade to v4.1.10 or later immediately. As a temporary workaround where patching is not immediately possible, restrict file operation permissions for authenticated users in shared storage environments and implement additional access controls to limit cross-user file access (OpenList Release v4.1.10, Patch Commit).

The vulnerability was discovered by the XlabAI Team of Tencent Xuanwu Lab using their Atuin Automated Vulnerability Discovery Engine, and was responsibly disclosed following the 90+30 day industry standard policy. Coverage appeared on The Hacker Wire and was shared across Mastodon and Bluesky shortly after disclosure (The Hacker Wire). No significant broader media coverage or notable researcher controversy has been identified.