Alist vulnerabilities

2 known vulnerabilities in Alist from AlistGo. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  alist: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-25161Feb 4, 2026AlistGo

  Alist is a file list program that supports multiple storages, powered by Gin and Solidjs. Prior to version 3.57.0, the application contains path traversal vulnerability in multiple file operation handlers. An authenticated attacker can bypass directory-level a

• 7.4 High severity

  alist: Improper Certificate Validation

  CVE-2026-25160Feb 4, 2026AlistGo

  Alist is a file list program that supports multiple storages, powered by Gin and Solidjs. Prior to version 3.57.0, the application disables TLS certificate verification by default for all outgoing storage driver communications, making the system vulnerable to