VendorsAListGoalistany version
Vulnerabilities

AListGo AList any version

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

5CVEs
CVE-2026-25160
Alist has Insecure TLS Config
Published 2026-02-04 · Analyzed
9.1EPSS 0.002
CVE-2026-25161
Alist vulnerable to Path Traversal in multiple file operation handlers
Published 2026-02-04 · Analyzed
8.8EPSS 0.008
CVE-2023-33498
alist <=3.16.3 is vulnerable to Incorrect Access Control. Low privilege accounts can upload any file.
Published 2023-06-07 · Analyzed
8.8EPSS 0.007
CVE-2022-26533
Alist v2.1.0 and below was discovered to contain a cross-site scripting (XSS) vulnerability via /i/:data/ipa.plist.
Published 2022-03-12 · Modified
6.1EPSS 0.007
CVE-2024-47067
Alist Contains a Reflected Cross-Site Scripting Vulnerability
Published 2024-09-30 · Analyzed
6.1EPSS 0.004