VendorsAListGoalistall versions
Vulnerabilities

AListGo AList

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

9CVEs
CVE-2022-45969
Alist v3.4.0 is vulnerable to Directory Traversal,
Published 2022-12-15 · Modified
9.8EPSS 0.012
CVE-2026-25160
Alist has Insecure TLS Config
Published 2026-02-04 · Analyzed
9.1EPSS 0.002
CVE-2022-45968
Alist v3.4.0 is vulnerable to File Upload. A user with only file upload permission can upload any file to any folder (even a password protected one).
Published 2022-12-12 · Modified
8.8EPSS 0.010
CVE-2026-25161
Alist vulnerable to Path Traversal in multiple file operation handlers
Published 2026-02-04 · Analyzed
8.8EPSS 0.008
CVE-2023-33498
alist <=3.16.3 is vulnerable to Incorrect Access Control. Low privilege accounts can upload any file.
Published 2023-06-07 · Analyzed
8.8EPSS 0.007
CVE-2023-31726
AList 3.15.1 is vulnerable to Incorrect Access Control, which can be exploited by attackers to obtain sensitive information.
Published 2023-05-23 · Modified
7.5EPSS 0.011
CVE-2022-26533
Alist v2.1.0 and below was discovered to contain a cross-site scripting (XSS) vulnerability via /i/:data/ipa.plist.
Published 2022-03-12 · Modified
6.1EPSS 0.007
CVE-2024-47067
Alist Contains a Reflected Cross-Site Scripting Vulnerability
Published 2024-09-30 · Analyzed
6.1EPSS 0.004
CVE-2022-45970
Alist v3.5.1 is vulnerable to Cross Site Scripting (XSS) via the bulletin board.
Published 2022-12-12 · Modified
5.4EPSS 0.005