Alist anfällig für Path Traversal in mehreren Dateioperation-Handlern in github.com/alist-org/alist

The Path Traversal vulnerability in alist allows an attacker to bypass intended access restrictions and read files outside of the intended directory. This could include sensitive configuration files, source code, or even user data. Successful exploitation could lead to the disclosure of credentials, API keys, or other confidential information. The impact is amplified if the alist instance is used to store sensitive data or is integrated with other systems, as an attacker could potentially gain access to broader resources through this initial foothold. This vulnerability is similar in nature to other path traversal flaws, where attackers manipulate file paths to access unauthorized resources.

Organizations and individuals using alist for file sharing and storage are at risk, particularly those running older versions prior to 3.57.0. Shared hosting environments where multiple users share the same alist instance are especially vulnerable, as a compromise of one user's account could potentially lead to access to other users' data.

• linux / server:

find /opt/alist -name '*alist*' -type f -exec grep -i '../' {} + # Search for '..' in alist files

• generic web:

curl -I 'http://your-alist-instance/../../../../etc/passwd' # Attempt to access sensitive files

• linux / server:

journalctl -u alist -f | grep -i 'path traversal' # Monitor alist logs for path traversal attempts

1. 2026-02-05Disclosure

   disclosure

1. Reserviert2026-01-29
2. Veröffentlicht2026-02-05
3. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-25161 is to upgrade alist to version 3.57.0 or later. If upgrading immediately is not feasible, consider implementing temporary workarounds such as restricting file access permissions and implementing stricter input validation on file paths. Web application firewalls (WAFs) configured with rules to detect and block path traversal attempts can also provide an additional layer of defense. Monitor alist logs for suspicious file access patterns, particularly requests containing directory traversal sequences like ../.