CVE-2026-25059: OpenList Frontend is a UI component for OpenList

Q: How do I fix CVE-2026-25059?

openlist: upgrade to 4.1.10. Exact commands for each OS are on this page.

Q: Is CVE-2026-25059 being exploited?

CVE-2026-25059 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2026-25059 affect?

CVE-2026-25059 affects openlist. Severity is high (CVSS 8.8). OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, the application contains path traversal vulnerability in multiple file operation handlers in server/handles/fsmanage.go. Filename components in req.Names are directly concat

Q: How urgent is CVE-2026-25059?

Priority 49/100. High severity; Public exploit reference

This month

HIGH 8.8UPGRADE

CVE-2026-25059 is a high-severity flaw (CVSS 8.8) affecting openlist. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, the application contains path traversal vulnerability in multiple file operation handlers in server/handles/fsmanage.go. Filename components in req.Names are directly concatenated with validated directories using stdpath.Join. This allows ".." sequences to bypass path restrictions, enabling users to access other users' files within the same storage mount and perform unauthorized a

Why this priority

High severity
Public exploit reference

A fixed release or distro patch exists.

Risk facts

CVSS score	8.8 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	Low
User interaction	None
EPSS exploit chance	0.7% (top 49%)
CISA exploited list	No
Weakness	CWE-22
Published	2026-02-02
Last modified	2026-06-17

Publisher (CNA): GitHub, Inc. · Vendor: oplist

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-02-02 23:16 UTCPublished CVE record published
2026-06-17 10:24 UTCUpdated Record last modified

oplist openlist UPGRADE

Affected: < 4.1.10

Fixed in: 4.1.10

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy openlist || rpm -q openlist || openlist --version

2. UPGRADE to 4.1.10 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade openlist

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade openlist

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-25059?

openlist: upgrade to 4.1.10. Exact commands for each OS are on this page.

Is CVE-2026-25059 being exploited?

CVE-2026-25059 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-25059 affect?

CVE-2026-25059 affects openlist. Severity is high (CVSS 8.8). OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, the application contains path traversal vulnerability in multiple file operation handlers in server/handles/fsmanage.go. Filename components in req.Names are directly concat

How urgent is CVE-2026-25059?

Priority 49/100. High severity; Public exploit reference

Related CVEs

CVE-2026-25060 HIGH 8.1 UPGRADE OpenList Frontend is a UI component for OpenList

References

← Back to latest CVEs