Go/github.com/OpenListTeam/OpenList/v4 CVE-2026-25059: high 8.8, EPSS 0.66%

OpenList vulnerable to Path Traversal in file copy and remove handlers in github.com/OpenListTeam/OpenList

Action: Upgrade github.com/OpenListTeam/OpenList/v4 to 4.1.10 or later.

go get github.com/OpenListTeam/OpenList/v4@v4.1.10

Affected

Fixed versions

Sources

• osv: GO-2026-4396#Go/github.com/OpenListTeam/OpenList/v4
• nvd: CVE-2026-25059
• https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-qmj2-8r24-xxcq
• https://github.com/OpenListTeam/OpenList/commit/7b78fed106382430c69ef351d43f5d09928fff14
• https://github.com/OpenListTeam/OpenList/blob/5db2172ed681346b69ed468c73c1f01b6ed455ea/server/handles/fsmanage.go#L163-L164
• https://github.com/OpenListTeam/OpenList/blob/5db2172ed681346b69ed468c73c1f01b6ed455ea/server/handles/fsmanage.go#L284-L285
• https://github.com/OpenListTeam/OpenList/releases/tag/v4.1.10

CVE-2026-25059 · published 2026-02-05T03:20:45Z · modified 2026-02-05T08:56:06.445047Z · JSON