GHSA-86cx-wwf4-phq4: OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API

An authorization bypass vulnerability exists in the file sharing mechanism of Openlist. Due to a flawed, non-separator-aware path validation check, an authenticated user can create share links for files outside their restricted base directory. This allows an attacker to bypass tenant/user isolation and gain unauthorized read access to arbitrary files within the system.