CVE-2026-25161: Path Traversal in alist

The Path Traversal vulnerability in alist allows an attacker to bypass intended access restrictions and read files outside of the intended directory. This could include sensitive configuration files, source code, or even user data. Successful exploitation could lead to the disclosure of credentials, API keys, or other confidential information. The impact is amplified if the alist instance is used to store sensitive data or is integrated with other systems, as an attacker could potentially gain access to broader resources through this initial foothold. This vulnerability is similar in nature to other path traversal flaws, where attackers manipulate file paths to access unauthorized resources.

1. Reserved2026-01-29
2. Published2026-02-05
3. EPSS updated2026-03-23

The primary mitigation for CVE-2026-25161 is to upgrade alist to version 3.57.0 or later. If upgrading immediately is not feasible, consider implementing temporary workarounds such as restricting file access permissions and implementing stricter input validation on file paths. Web application firewalls (WAFs) configured with rules to detect and block path traversal attempts can also provide an additional layer of defense. Monitor alist logs for suspicious file access patterns, particularly requests containing directory traversal sequences like ../.