PT-2026-6278 · Alist · Alist

A7Um + 1 · Publicado 2026-02-04 · Atualizado 2026-02-06 · CVE-2026-25160

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Alist versions prior to 3.57.0

Description Alist, a file list program powered by Gin and Solidjs, has a configuration issue where TLS certificate verification is disabled by default for all outgoing storage driver communications. This allows for potential Man-in-the-Middle (MitM) attacks, enabling decryption, theft, and manipulation of data transmitted during storage operations. This compromises the confidentiality and integrity of user data.

Recommendations Update to version 3.57.0 or later.

Exploit

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2026-25160

GHSA-8JMM-3XWX-W974

GO-2026-4414

SUSE-SU-2026:0403-1

Produtos afetados

Alist

Referências · 92

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25160.json · Exploit
• https://github.com/AlistGo/alist/commit/69629ca76a8f2c8c973ede3b616f93aa26ff23fb · Correção
• https://github.com/AlistGo/alist/security/advisories/GHSA-8jmm-3xwx-w974 · Aviso do Fabricante
• https://github.com/AlistGo/alist · Nota
• https://github.com/AlistGo/alist/releases/tag/v3.57.0 · Nota
• https://suse.com/security/cve/CVE-2026-24117 · Nota
• https://suse.com/security/cve/CVE-2023-43630 · Nota
• https://suse.com/security/cve/CVE-2026-23954 · Nota
• https://suse.com/security/cve/CVE-2026-24740 · Nota
• https://suse.com/security/cve/CVE-2026-25499 · Nota
• https://suse.com/security/cve/CVE-2026-23517 · Nota
• https://twitter.com/CveFindCom/status/2019428571949756823 · Publicação no Twitter
• https://suse.com/security/cve/CVE-2026-24844 · Nota
• https://suse.com/security/cve/CVE-2026-25578 · Nota
• https://suse.com/security/cve/CVE-2026-23991 · Nota