OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-75602 · CVE overview and exploitation status

EUVD-2026-70550

GHSA-h6cj-26g5-67fv

GO-2026-6368

cve-program · CVE-2026-75602

• https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-h6cj-26g5-67fv
• https://github.com/OpenListTeam/OpenList/commit/9cc5dd969b9833c8cb4e14c338c3571dfdbe2108
• https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.3

euvd · EUVD-2026-70550

• https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-h6cj-26g5-67fv
• https://github.com/OpenListTeam/OpenList/commit/9cc5dd969b9833c8cb4e14c338c3571dfdbe2108
• https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.3

nvd · CVE-2026-75602

• https://github.com/OpenListTeam/OpenList/commit/9cc5dd969b9833c8cb4e14c338c3571dfdbe2108
• https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.3
• https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-h6cj-26g5-67fv

osv · GHSA-h6cj-26g5-67fv

• https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-h6cj-26g5-67fv
• https://github.com/OpenListTeam/OpenList/commit/9cc5dd969b9833c8cb4e14c338c3571dfdbe2108
• https://github.com/OpenListTeam/OpenList
• https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.3

osv · GO-2026-6368

• https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-h6cj-26g5-67fv
• https://github.com/OpenListTeam/OpenList/commit/9cc5dd969b9833c8cb4e14c338c3571dfdbe2108
• https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.3

No related changes are available here.