{"id":"GO-2026-6109","revision":"fde5d385a46c40b8b0b159975e5c0aa8","records":[{"revision":"fde5d385a46c40b8b0b159975e5c0aa8","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6109","aliases":["CVE-2026-69160","GHSA-86cx-wwf4-phq4"],"title":"OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API in github.com/OpenListTeam/OpenList","description":"OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API in github.com/OpenListTeam/OpenList","state":0,"publishedAt":"2026-08-18T14:32:29+00:00","modifiedAt":"2026-08-18T18:49:43.6962333+00:00","affected":[{"ecosystem":"Go","name":"github.com/OpenListTeam/OpenList","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/OpenListTeam/OpenList/v3","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/OpenListTeam/OpenList/v4","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"4.2.4"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-86cx-wwf4-phq4","https://github.com/OpenListTeam/OpenList/commit/59bd3431408578f420895457554700cc9a52375a","https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6109","license":"OSV · upstream source license applies","key":"osv:GO-2026-6109","identifiers":["GO-2026-6109","CVE-2026-69160","GHSA-86cx-wwf4-phq4"]},"retained":false,"historicalAffected":[]}],"coverage":[]}