OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-73509 · CVE overview and exploitation status

EUVD-2026-58087

GHSA-95cv-r8x4-vh75

GO-2026-6110

cve-program · CVE-2026-73509

• https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-95cv-r8x4-vh75
• https://github.com/OpenListTeam/OpenList/commit/651da18da4c647d96648d4bb64462baac1c37e04
• https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4

euvd · EUVD-2026-58087

• https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-95cv-r8x4-vh75
• https://github.com/OpenListTeam/OpenList/commit/651da18da4c647d96648d4bb64462baac1c37e04
• https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4

nvd · CVE-2026-73509

• https://github.com/OpenListTeam/OpenList/commit/651da18da4c647d96648d4bb64462baac1c37e04
• https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4
• https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-95cv-r8x4-vh75

osv · GHSA-95cv-r8x4-vh75

• https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-95cv-r8x4-vh75
• https://github.com/OpenListTeam/OpenList/commit/651da18da4c647d96648d4bb64462baac1c37e04
• https://github.com/OpenListTeam/OpenList
• https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4

osv · GO-2026-6110

• https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-95cv-r8x4-vh75
• https://github.com/OpenListTeam/OpenList/commit/651da18da4c647d96648d4bb64462baac1c37e04
• https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4

No related changes are available here.