PT-2026-6279 · Alist · Alist

A7Um + 1 · Publicado 2026-02-04 · Atualizado 2026-02-06 · CVE-2026-25161

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Alist versions prior to 3.57.0

Description Alist is a file list program that supports multiple storages, powered by Gin and Solidjs. The application contains a path traversal issue in multiple file operation handlers. An authenticated attacker can bypass directory-level authorization by injecting traversal sequences into filename components. This allows unauthorized file removal, movement, and copying across user boundaries within the same storage mount. The vulnerability affects file operations and potentially compromises data integrity and confidentiality.

Recommendations Update to version 3.57.0 or later.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-25161

GHSA-X4Q4-7PHH-42J9

GO-2026-4415

SUSE-SU-2026:0403-1

Produtos afetados

Alist

Referências · 92

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25161.json · Exploit
• https://github.com/AlistGo/alist/commit/b188288525b9a35c76535139311e7c036dab057e · Correção
• https://github.com/AlistGo/alist · Nota
• https://github.com/AlistGo/alist/security/advisories/GHSA-x4q4-7phh-42j9 · Aviso do Fabricante
• https://github.com/AlistGo/alist/blob/b4d9beb49cba399842a54fcc33bc95a4a09b7bd4/server/handles/fsmanage.go#L165-L166 · Nota
• https://github.com/AlistGo/alist/blob/b4d9beb49cba399842a54fcc33bc95a4a09b7bd4/server/handles/fsbatch.go#L188-L189 · Nota
• https://suse.com/security/cve/CVE-2026-24117 · Nota
• https://suse.com/security/cve/CVE-2023-43630 · Nota
• https://suse.com/security/cve/CVE-2026-23954 · Nota
• https://suse.com/security/cve/CVE-2026-24740 · Nota
• https://suse.com/security/cve/CVE-2026-25499 · Nota
• https://suse.com/security/cve/CVE-2026-23517 · Nota
• https://suse.com/security/cve/CVE-2026-24844 · Nota
• https://suse.com/security/cve/CVE-2026-25578 · Nota
• https://suse.com/security/cve/CVE-2026-23991 · Nota