{"id":"CVE-2026-103398","published":"2026-09-30T15:22:28.800","lastModified":"2026-09-30T17:32:07.107","description":"OpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. Attackers can specify arbitrary directories outside configured save locations to read and write files through manifest and sync routes.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-73"],"vendors":[],"products":[],"references":[{"url":"https://gist.github.com/mansurmavlankulov/2ca66f95965fb9d4aab353bcf2434cdb","tags":[]},{"url":"https://github.com/Liquid-co/OpenSave","tags":[]},{"url":"https://github.com/Liquid-co/OpenSave/blob/v2.4.0/internal/delta/rootguard.go#L16-L30","tags":[]},{"url":"https://github.com/Liquid-co/OpenSave/blob/v2.4.0/internal/p2p/routes.go#L555-L566","tags":[]},{"url":"https://www.vulncheck.com/advisories/opensave-through-2.4.0-arbitrary-file-read-and-write-via-peer-controlled-save-path","tags":[]}],"exploitRefs":[{"url":"https://gist.github.com/mansurmavlankulov/2ca66f95965fb9d4aab353bcf2434cdb","tags":[]},{"url":"https://github.com/Liquid-co/OpenSave","tags":[]},{"url":"https://github.com/Liquid-co/OpenSave/blob/v2.4.0/internal/delta/rootguard.go#L16-L30","tags":[]},{"url":"https://github.com/Liquid-co/OpenSave/blob/v2.4.0/internal/p2p/routes.go#L555-L566","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows attackers to read and write files in arbitrary directories outside the configured save locations by manipulating save paths in the manifest request handler, posing a significant security risk.","exploitability":"Exploitation is relatively straightforward given the preconditions of paired peers and the ability to specify arbitrary directories. Attackers must have access to the paired peer's manifest request handler.","blast_radius":"If exploited, this vulnerability could lead to unauthorized access and manipulation of sensitive files across the network, with potential for data theft or corruption.","remediation":"Upgrade to OpenSave version 2.4.1 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["file-write","file-read","manifest","pairing"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-05T08:43:52.376Z"}}