Affected by GO-2026-6109
and 3 other vulnerabilities
GO-2026-6109: OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API in github.com/OpenListTeam/OpenList
GO-2026-6110: OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal in github.com/OpenListTeam/OpenList
GO-2026-6113: OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search in github.com/OpenListTeam/OpenList
GO-2026-6368: OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool in github.com/OpenListTeam/OpenList
GrantAdminPermissions gives admin Permission 0(can see hidden) - 9(webdav manage) and
12(can read archives) - 13(can decompress archives)
This patch is written to help users upgrading from older version better adapt
Affected by 
Documentation
¶
Source Files