What’s Vulnerable › Vulnerabilities

CVE-2026-103398: OpenSave through 2.4.0 Arbitrary File Read and Write via Peer-Controlled Save Path

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-30 · updated 2026-09-30
• Weakness: CWE-73

Description

OpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. Attackers can specify arbitrary directories outside configured save locations to read and write files through manifest and sync routes.

Affected products

• Liquid-co OpenSave: through 2.4.0

References

• https://gist.github.com/mansurmavlankulov/2ca66f95965fb9d4aab353bcf2434cdb
• https://github.com/Liquid-co/OpenSave
• https://github.com/Liquid-co/OpenSave/blob/v2.4.0/internal/delta/rootguard.go#L16-L30
• https://github.com/Liquid-co/OpenSave/blob/v2.4.0/internal/p2p/routes.go#L555-L566
• https://www.vulncheck.com/advisories/opensave-through-2.4.0-arbitrary-file-read-and-write-via-peer-controlled-save-path

Get alerted when CVE-2026-103398 or the next vulnerability affects your stack