—Go
GO-2026-4396· CVE-2026-25059, GHSA-qmj2-8r24-xxcqOpenList vulnerable to Path Traversal in file copy and remove handlers in github.com/OpenListTeam/OpenList
Modified: 2/5/2026
package
Go/github.com/OpenListTeam/OpenList/v3
pkg:go/github.com/OpenListTeam/OpenList/v3
—Go
GO-2026-4397· CVE-2026-25060, GHSA-wf93-3ghh-h389OpenList has Insecure TLS Default Configuration in github.com/OpenListTeam/OpenList
Modified: 2/5/2026
—Go
GO-2026-6109· CVE-2026-69160, GHSA-86cx-wwf4-phq4OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API in github.com/OpenListTeam/OpenList
Modified: 8/18/2026
—Go
GO-2026-6110· CVE-2026-73509, GHSA-95cv-r8x4-vh75OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal in github.com/OpenListTeam/OpenList
Modified: 8/18/2026
—Go
GO-2026-6113· GHSA-p6ph-3jx2-3337OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search in github.com/OpenListTeam/OpenList
Modified: 8/18/2026
—Go
GO-2026-6368· CVE-2026-75602, GHSA-h6cj-26g5-67fvOpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool in github.com/OpenListTeam/OpenList
Modified: 9/10/2026