Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/alist-org/alist/v3

7 known vulnerabilities (2 critical, 3 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
v3.66.0 (Oct 21, 2026): no advisory affects it
Newest unaffected release
v3.66.0 (Oct 21, 2026), the latest release
Advisories
7 · 2 critical, 3 high, 2 medium
Releases
104 since v3.0.1 (Sep 22, 2022)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 7

  • Alist vulnerable to Path Traversal in multiple file operation handlers

    Affected: fixed in 3.57.0.

    Fixed in v3.57.0 (released Feb 4, 2026, the day of disclosure).

    The latest release, v3.66.0, is not affected.

  • CVE-2026-25160Critical 9.1

    Alist has Insecure TLS Config

    Affected: fixed in 3.57.0.

    Fixed in v3.57.0 (released Feb 4, 2026, the day of disclosure).

    The latest release, v3.66.0, is not affected.

  • CVE-2024-47067Medium 5.1

    Alist Contains a Reflected Cross-Site Scripting Vulnerability

    Affected: fixed in 3.29.0.

    Fixed in v3.29.0 (released Nov 24, 2023, 311 days before disclosure).

    The latest release, v3.66.0, is not affected.

  • alist <=3.16.3 is vulnerable to Incorrect Access Control.

    Affected: through 3.16.3.

    Fixed in v3.17.0 (released May 14, 2023, 24 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, v3.66.0, is not affected.

  • CVE-2022-45969Critical 9.8

    Alist v3.4.0 is vulnerable to Directory Traversal,

    Affected: fixed in 3.6.0.

    Fixed in v3.6.0 (released Dec 5, 2022, 10 days before disclosure).

    The latest release, v3.66.0, is not affected.

  • CVE-2022-45970Medium 5.4

    Alist v3.5.1 is vulnerable to Cross Site Scripting (XSS) via the bulletin board.

    Affected: through 3.5.1.

    Fixed in v3.6.0 (released Dec 5, 2022, 7 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, v3.66.0, is not affected.

  • Alist v3.4.0 is vulnerable to File Upload.

    Affected: fixed in 3.5.1.

    Fixed in v3.5.1 (released Nov 22, 2022, 20 days before disclosure).

    The latest release, v3.66.0, is not affected.