CVE-2026-103398
OpenSave through 2.4.0 Arbitrary File Read and Write via Peer-Controlled Save Path
Liquid-co OpenSave
CVSS
8.6HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.27%Chance of exploitation activity in the next 30 days, higher than 17% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
OpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. Attackers can specify arbitrary directories outside configured save locations to read and write files through manifest and sync routes.
Text from CVE List
Affected versions 1
- OpenSaveaffected: all versions through 2.4.0CVE List
References 5
- gist.github.com/mansurmavlankulov/2ca66f95965fb9d4aab353bcf2434cdbAdvisoryvia CVE List
- vulncheck.com/advisories/opensave-through-2.4.0-arbitrary-file-read-and-write-via-peer-controlled-save-pathAdvisoryvia CVE List
- github.com/Liquid-co/OpenSave/blob/v2.4.0/internal/p2p/routes.go#L555-L566Referencevia CVE List
- github.com/Liquid-co/OpenSave/blob/v2.4.0/internal/delta/rootguard.go#L16-L30Referencevia CVE List
- github.com/Liquid-co/OpenSaveReferencevia CVE List