Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/alist-org/alist

5 known vulnerabilities (2 critical, 2 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
5 · 2 critical, 2 high, 1 medium
Registry
pkg.go.dev

Advisories 5

  • Alist vulnerable to Path Traversal in multiple file operation handlers

    Affected: all versions.

  • CVE-2026-25160Critical 9.1

    Alist has Insecure TLS Config

    Affected: all versions.

  • CVE-2024-47067Medium 5.1

    Alist Contains a Reflected Cross-Site Scripting Vulnerability

    Affected: all versions.

  • CVE-2022-45969Critical 9.8

    Alist v3.4.0 is vulnerable to Directory Traversal,

    Affected: all versions.

  • Alist v3.4.0 is vulnerable to File Upload.

    Affected: all versions.