CVE-2026-25161

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25161", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-29T15:39:11.822Z", "datePublished": "2026-02-04T19:40:04.668Z", "dateUpdated": "2026-02-05T14:32:40.886Z"}, "containers": {"cna": {"title": "Alist vulnerable to Path Traversal in multiple file operation handlers", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/AlistGo/alist/security/advisories/GHSA-x4q4-7phh-42j9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/AlistGo/alist/security/advisories/GHSA-x4q4-7phh-42j9"}, {"name": "https://github.com/AlistGo/alist/commit/b188288525b9a35c76535139311e7c036dab057e", "tags": ["x_refsource_MISC"], "url": "https://github.com/AlistGo/alist/commit/b188288525b9a35c76535139311e7c036dab057e"}], "affected": [{"vendor": "AlistGo", "product": "alist", "versions": [{"version": "< 3.57.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-04T19:40:04.668Z"}, "descriptions": [{"lang": "en", "value": "Alist is a file list program that supports multiple storages, powered by Gin and Solidjs. Prior to version 3.57.0, the application contains path traversal vulnerability in multiple file operation handlers. An authenticated attacker can bypass directory-level authorisation by injecting traversal sequences into filename components, enabling unauthorised file removal, movement and copying across user boundaries within the same storage mount. This issue has been patched in version 3.57.0."}], "source": {"advisory": "GHSA-x4q4-7phh-42j9", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-05T14:23:11.212176Z", "id": "CVE-2026-25161", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-05T14:32:40.886Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25161", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-05T14:23:11.212176Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-05T14:23:11.853Z"}}], "cna": {"title": "Alist vulnerable to Path Traversal in multiple file operation handlers", "source": {"advisory": "GHSA-x4q4-7phh-42j9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "AlistGo", "product": "alist", "versions": [{"status": "affected", "version": "< 3.57.0"}]}], "references": [{"url": "https://github.com/AlistGo/alist/security/advisories/GHSA-x4q4-7phh-42j9", "name": "https://github.com/AlistGo/alist/security/advisories/GHSA-x4q4-7phh-42j9", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/AlistGo/alist/commit/b188288525b9a35c76535139311e7c036dab057e", "name": "https://github.com/AlistGo/alist/commit/b188288525b9a35c76535139311e7c036dab057e", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Alist is a file list program that supports multiple storages, powered by Gin and Solidjs. Prior to version 3.57.0, the application contains path traversal vulnerability in multiple file operation handlers. An authenticated attacker can bypass directory-level authorisation by injecting traversal sequences into filename components, enabling unauthorised file removal, movement and copying across user boundaries within the same storage mount. This issue has been patched in version 3.57.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-04T19:40:04.668Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25161", "state": "PUBLISHED", "dateUpdated": "2026-02-05T14:32:40.886Z", "dateReserved": "2026-01-29T15:39:11.822Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-04T19:40:04.668Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "alist", "vendor": "AlistGo", "versions": [{"status": "affected", "version": "< 3.57.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:alistgo:alist:*:*:*:*:*:*:*:*", "matchCriteriaId": "6604E5A5-7438-488A-97E5-7632264956BF", "versionEndExcluding": "3.57.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Alist is a file list program that supports multiple storages, powered by Gin and Solidjs. Prior to version 3.57.0, the application contains path traversal vulnerability in multiple file operation handlers. An authenticated attacker can bypass directory-level authorisation by injecting traversal sequences into filename components, enabling unauthorised file removal, movement and copying across user boundaries within the same storage mount. This issue has been patched in version 3.57.0."}, {"lang": "es", "value": "Alist es un programa de listado de archivos que soporta m\u00faltiples almacenamientos, impulsado por Gin y Solidjs. Antes de la versi\u00f3n 3.57.0, la aplicaci\u00f3n contiene una vulnerabilidad de salto de ruta en m\u00faltiples manejadores de operaciones de archivo. Un atacante autenticado puede eludir la autorizaci\u00f3n a nivel de directorio inyectando secuencias de salto de ruta en los componentes del nombre de archivo, lo que permite la eliminaci\u00f3n, movimiento y copia de archivos no autorizados entre l\u00edmites de usuario dentro del mismo montaje de almacenamiento. Este problema ha sido parcheado en la versi\u00f3n 3.57.0."}], "id": "CVE-2026-25161", "lastModified": "2026-06-17T10:24:12.760", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25161", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-05T14:23:11.212176Z", "version": "2.0.3"}}]}, "published": "2026-02-04T20:16:06.870", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/AlistGo/alist/commit/b188288525b9a35c76535139311e7c036dab057e"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/AlistGo/alist/security/advisories/GHSA-x4q4-7phh-42j9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-17T23:18:24.688041+00:00", "value": {"mitigation_remediation": ["Update Alist to version 3.57.0 or newer; this releases the patch that removes the traversal vectors.", "If an upgrade is not immediately possible, restrict the permissions of authenticated users to prevent them from performing delete, move, or copy operations, thereby limiting the impact of the traversal flaw.", "Apply a file\u2011system or application\u2011layer filter to reject filenames containing \"..\" or other traversal patterns until the official update can be applied."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized file removal, movement, and copying across user boundaries"}, "threat_synthesis": {"affected_systems": "The vulnerability applies to AlistGo: Alist deployments running any version before 3.57.0. Versions 3.57.0 and later contain the fix and are not affected.", "description_and_impact": "Alist is vulnerable to a path traversal flaw in several file operation handlers. An attacker who has authenticated access can inject traversal sequences into filename components, which allows that attacker to bypass ordinary directory\u2011level authorization checks. The consequence is that the attacker can delete, move, or copy files across user boundaries within the same storage mount, effectively erasing or exfiltrating other users' data without permissions.", "risk_and_exploitability": "The CVSS score is 8.8, indicating a high severity. The EPSS score is below 1\u202f%, showing that exploitation likelihood is currently low but not nonexistent, and the flaw is not yet listed in CISA\u2019s KEV catalog. Exploitation requires a legitimate authenticated session; with such access the attacker can craft file names containing traversal sequences and execute dele\u2011, move\u2011, or copy\u2011type operations, thereby compromising data integrity and potentially confidentiality across users."}}}}, "created": "2026-02-05T11:39:10.309758+00:00", "updated": "2026-04-17T23:30:15.905107+00:00", "vendors": ["alistgo", "alistgo$PRODUCT$alist"]}