CVE-2026-126949

Zipline through version 4.4.0 is vulnerable to a path traversal vulnerability in the PATCH /api/user/files/:id rename endpoint. This flaw allows authenticated users with high privileges to overwrite existing uploads by providing unsanitized names . Because the system performs a database uniquenes...

EUVD-2026-58087

OpenList a file list program that supports multiple storage. Prior to 4.2.4, the authenticated /api/fs/batchrename handler in server/handles/fsbatch.go authorizes only the source directory produced by user.JoinPathreq.SrcDir and validates renameObject.NewName with checkRelativePath, but does not...

CVE-2026-73509

OpenList a file list program that supports multiple storage. Prior to 4.2.4, the authenticated /api/fs/batchrename handler in server/handles/fsbatch.go authorizes only the source directory produced by user.JoinPathreq.SrcDir and validates renameObject.NewName with checkRelativePath, but does not...