High · 8.8 CVE-2022-45968 EUVD-2022-7504GHSA-4gjr-vgfx-9qvwGO-2022-1161

AList vulnerable to Improper Preservation of Permissions

Published Dec 12, 2022 · Updated Apr 22, 2025 · Assigned by mitre

Description

Alist v3.4.0 is vulnerable to File Upload. A user with only file upload permission can upload any file to any folder (even a password protected one).

Ecosystem	Package	Affected	Fixed	Record
Go	github.com/alist-org/alist	all versions	—	GO-2022-1161
Go	github.com/alist-org/alist/v3	< 3.5.1	3.5.1	GHSA-4gjr-vgfx-9qvw