github.com/alist-org/alist

5 results · Feed

• High 8.8
  CVE-2026-25161

  Alist vulnerable to Path Traversal in multiple file operation handlers

  Alist is a file list program that supports multiple storages, powered by Gin and Solidjs. Prior to version 3.57.0, the application contains path traversal vulnerability in multiple file operation handlers. An authenticated attacker can bypass directory-level …

  AlistGo alist github.com/alist-org/alist/v3 github.com/alist-org/alist Go
  Feb 4, 2026
• Critical 9.1
  CVE-2026-25160

  Alist has Insecure TLS Config

  Alist is a file list program that supports multiple storages, powered by Gin and Solidjs. Prior to version 3.57.0, the application disables TLS certificate verification by default for all outgoing storage driver communications, making the system vulnerable to…

  AlistGo alist github.com/alist-org/alist/v3 github.com/alist-org/alist Go
  Feb 4, 2026
• Medium 5.1
  CVE-2024-47067

  Alist Contains a Reflected Cross-Site Scripting Vulnerability

  AList is a file list program that supports multiple storages. AList contains a reflected cross-site scripting vulnerability in helper.go. The endpoint /i/:link_name takes in a user-provided value and reflects it back in the response. The endpoint returns an a…

  alist-org alist github.com/alist-org/alist/v3 github.com/alist-org/alist Go
  Sep 30, 2024
• Critical 9.8
  CVE-2022-45969

  Alist vulnerable to Path Traversal

  Alist v3.4.0 is vulnerable to Directory Traversal,

  github.com/alist-org/alist/v3 github.com/alist-org/alist Go
  Dec 15, 2022
• High 8.8
  CVE-2022-45968

  AList vulnerable to Improper Preservation of Permissions

  Alist v3.4.0 is vulnerable to File Upload. A user with only file upload permission can upload any file to any folder (even a password protected one).

  github.com/alist-org/alist/v3 github.com/alist-org/alist Go
  Dec 12, 2022