VYPR
← All advisories
High severityOSV Advisory· Published Feb 2, 2026· Updated Feb 4, 2026

OpenList Insecure TLS Default Configuration

CVE-2026-25060

Description

OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, certificate verification is disabled by default for all storage driver communications. The TlsInsecureSkipVerify setting is default to true in the DefaultConfig() function in internal/conf/config.go. This vulnerability enables Man-in-the-Middle (MitM) attacks by disabling TLS certificate verification, allowing attackers to intercept and manipulate all storage communications. Attackers can exploit this through network-level attacks like ARP spoofing, rogue Wi-Fi access points, or compromised internal network equipment to redirect traffic to malicious endpoints. Since certificate validation is skipped, the system will unknowingly establish encrypted connections with attacker-controlled servers, enabling full decryption, data theft, and manipulation of all storage operations without triggering any security warnings. This vulnerability is fixed in 4.1.10.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/OpenListTeam/OpenList/v4Go
< 4.1.104.1.10

Affected products

1

Patches

1
e3c664f81d05

Merge commit from fork

https://github.com/OpenListTeam/OpenListShenLinJan 31, 2026via ghsa
commit
5 files changed · +38 −3
  • internal/bootstrap/config.go+1 −0 modified
    @@ -54,6 +54,7 @@ func InitConfig() {
 		}
 	}
 	configPath = filepath.Clean(configPath)
+	conf.ConfigPath = configPath
 	log.Infof("reading config file: %s", configPath)
 	if !utils.Exists(configPath) {
 		log.Infof("config file not exists, creating default config file")
  • internal/bootstrap/patch/all.go+1 −0 modified
    @@ -44,6 +44,7 @@ var UpgradePatches = []VersionPatches{
 		Version: "v4.1.9",
 		Patches: []func(){
 			v4_1_9.EnableWebDavProxy,
+			v4_1_9.ResetSkipTlsVerify,
 		},
 	},
 }
  • internal/bootstrap/patch/v4_1_9/skip_tls.go+32 −0 added
    @@ -0,0 +1,32 @@
+package v4_1_9
+
+import (
+	"os"
+	"strings"
+
+	"github.com/OpenListTeam/OpenList/v4/internal/conf"
+	"github.com/OpenListTeam/OpenList/v4/pkg/utils"
+)
+
+func ResetSkipTlsVerify() {
+	if !conf.Conf.TlsInsecureSkipVerify {
+		return
+	}
+	if !strings.HasPrefix(conf.Version, "v") {
+		return
+	}
+
+	conf.Conf.TlsInsecureSkipVerify = false
+
+	confBody, err := utils.Json.MarshalIndent(conf.Conf, "", "  ")
+	if err != nil {
+		utils.Log.Errorf("[ResetSkipTlsVerify] failed to rewrite config: marshal config error: %+v", err)
+		return
+	}
+	err = os.WriteFile(conf.ConfigPath, confBody, 0o777)
+	if err != nil {
+		utils.Log.Errorf("[ResetSkipTlsVerify] failed to rewrite config: update config struct error: %+v", err)
+		return
+	}
+	utils.Log.Infof("[ResetSkipTlsVerify] succeeded to set tls_insecure_skip_verify to false")
+}
  • internal/conf/config.go+1 −1 modified
    @@ -182,7 +182,7 @@ func DefaultConfig(dataDir string) *Config {
 		MmapThreshold:         4,
 		MaxConnections:        0,
 		MaxConcurrency:        64,
-		TlsInsecureSkipVerify: true,
+		TlsInsecureSkipVerify: false,
 		Tasks: TasksConfig{
 			Download: TaskConfig{
 				Workers:  5,
  • internal/conf/var.go+3 −2 modified
    @@ -15,8 +15,9 @@ var (
 )
 
 var (
-	Conf *Config
-	URL  *url.URL
+	Conf       *Config
+	URL        *url.URL
+	ConfigPath string
 )
 
 var SlicesMap = make(map[string][]string)

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.