high8.1
CVE-2026-103398
OpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler.
Impact
OpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. Attackers can specify arbitrary directories outside configured save locations to read and write files through manifest and sync routes.
Affected products
| Product | Affected versions |
|---|---|
| OpenSave | through 2.4.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- https://gist.github.com/mansurmavlankulov/2ca66f95965fb9d4aab353bcf2434cdb
- https://github.com/Liquid-co/OpenSave
- https://github.com/Liquid-co/OpenSave/blob/v2.4.0/internal/delta/rootguard.go#L16-L30
- https://github.com/Liquid-co/OpenSave/blob/v2.4.0/internal/p2p/routes.go#L555-L566
- https://www.vulncheck.com/advisories/opensave-through-2.4.0-arbitrary-file-read-and-write-via-peer-controlled-save-path