GO-2026-4415
NoneCVSS
—
EPSS
—
Published
Feb 5, 2026
CISA due date
—
The record
Alist vulnerable to Path Traversal in multiple file operation handlers in github.com/alist-org/alist
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/alist-org/alist | 0 | No fix |
| Go | github.com/alist-org/alist/v3 | 0 | 3.57.0 |
Related vulnerabilities
- CVE-2026-25161 Alist is a file list program that supports multiple storages, powered by Gin and Solidjs. Same vulnerability
- GO-2026-4414 Alist has Insecure TLS Config in github.com/alist-org/alist Also affects github.com/alist-org/alist
- CVE-2026-25160 Alist is a file list program that supports multiple storages, powered by Gin and Solidjs. Also affects github.com/alist-org/alist