PT-2026-6278 · Alist · Alist

A7Um + 1 · Published 2026-02-04 · Updated 2026-02-06 · CVE-2026-25160

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Alist versions prior to 3.57.0

Description Alist, a file list program powered by Gin and Solidjs, has a configuration issue where TLS certificate verification is disabled by default for all outgoing storage driver communications. This allows for potential Man-in-the-Middle (MitM) attacks, enabling decryption, theft, and manipulation of data transmitted during storage operations. This compromises the confidentiality and integrity of user data.

Recommendations Update to version 3.57.0 or later.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2026-25160

GHSA-8JMM-3XWX-W974

GO-2026-4414

SUSE-SU-2026:0403-1

Affected Products

Alist

References · 92

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25160.json · Exploit
• https://github.com/AlistGo/alist/commit/69629ca76a8f2c8c973ede3b616f93aa26ff23fb · Patch
• https://github.com/AlistGo/alist/security/advisories/GHSA-8jmm-3xwx-w974 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4414 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0403-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8jmm-3xwx-w974 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25160 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25160 · Vendor Advisory
• https://github.com/AlistGo/alist · Note
• https://github.com/AlistGo/alist/releases/tag/v3.57.0 · Note
• https://suse.com/security/cve/CVE-2026-24117 · Note
• https://suse.com/security/cve/CVE-2023-43630 · Note
• https://suse.com/security/cve/CVE-2026-23954 · Note
• https://suse.com/security/cve/CVE-2026-24740 · Note
• https://suse.com/security/cve/CVE-2026-25499 · Note