GHSA-P6PH-3JX2-3337 OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search

Summary An authorization bypass and information disclosure vulnerability exists in the search API of Openlist. Due to a non-separator-aware path check and unfiltered backend counting, a low-privileged user can bypass their assigned BasePath restrictions to discover and access metadata of files...