PT-2026-6279 · Alist · Alist

A7Um + 1 · Published 2026-02-04 · Updated 2026-02-06 · CVE-2026-25161

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Alist versions prior to 3.57.0

Description Alist is a file list program that supports multiple storages, powered by Gin and Solidjs. The application contains a path traversal issue in multiple file operation handlers. An authenticated attacker can bypass directory-level authorization by injecting traversal sequences into filename components. This allows unauthorized file removal, movement, and copying across user boundaries within the same storage mount. The vulnerability affects file operations and potentially compromises data integrity and confidentiality.

Recommendations Update to version 3.57.0 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-25161

GHSA-X4Q4-7PHH-42J9

GO-2026-4415

SUSE-SU-2026:0403-1

Affected Products

Alist

References · 92

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25161.json · Exploit
• https://github.com/AlistGo/alist/commit/b188288525b9a35c76535139311e7c036dab057e · Patch
• https://github.com/AlistGo/alist/security/advisories/GHSA-x4q4-7phh-42j9 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x4q4-7phh-42j9 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4415 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25161 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25161 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:0403-1 · Vendor Advisory
• https://github.com/AlistGo/alist · Note
• https://github.com/AlistGo/alist/blob/b4d9beb49cba399842a54fcc33bc95a4a09b7bd4/server/handles/fsmanage.go#L165-L166 · Note
• https://github.com/AlistGo/alist/blob/b4d9beb49cba399842a54fcc33bc95a4a09b7bd4/server/handles/fsbatch.go#L188-L189 · Note
• https://suse.com/security/cve/CVE-2026-24117 · Note
• https://suse.com/security/cve/CVE-2023-43630 · Note
• https://suse.com/security/cve/CVE-2026-23954 · Note
• https://suse.com/security/cve/CVE-2026-24740 · Note