AlistGo

Records9All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high4CVSS 7.0–8.9

Exploited now

AlistGo records in CISA KEV

No AlistGo vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Alist 9 records HIGH

Records

9 records in Alist · all components

TI-2022-22731 CVE-2022-45969 · GHSA-pmg2-rph8-p8r6

Alist v3.4.0 is vulnerable to Directory Traversal,

HIGH 82

Alist v3.4.0 is vulnerable to Directory Traversal,

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01232 Published 2022-12-15 Fixed in 3.6.0 CWE-22

TI-2022-22730 CVE-2022-45968 · GHSA-4gjr-vgfx-9qvw

Alist v3.4.0 is vulnerable to File Upload.

HIGH 73

Alist v3.4.0 is vulnerable to File Upload.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0102 Published 2022-12-12 Fixed in 3.5.1 CWE-434

TI-2023-15192 CVE-2023-31726 · GHSA-rq2h-mjp2-vqpr

AList 3.15.1 is vulnerable to Incorrect Access Control, which can be exploited by…

HIGH 72

AList 3.15.1 is vulnerable to Incorrect Access Control, which can be exploited by attackers to obtain sensitive information.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01058 Published 2023-05-23 No fix listed CWE-863

TI-2022-22732 CVE-2022-45970 · GHSA-957m-g6rf-4c2m

Alist v3.5.1 is vulnerable to Cross Site Scripting (XSS) via the bulletin board.

MEDIUM 58

Alist v3.5.1 is vulnerable to Cross Site Scripting (XSS) via the bulletin board.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00488 Published 2022-12-12 No fix listed CWE-79

TI-2024-31449 CVE-2024-47067 · GHSA-8pph-gfhp-w226

Alist Contains a Reflected Cross-Site Scripting Vulnerability

MEDIUM 56

AList is a file list program that supports multiple storages.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00422 Published 2024-09-30 Fixed in 3.29.0 CWE-79

TI-2026-20320 CVE-2026-25160 · GHSA-8jmm-3xwx-w974

Alist has Insecure TLS Config

MEDIUM 47

Alist is a file list program that supports multiple storages, powered by Gin and Solidjs.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.0025 Published 2026-02-04 Fixed in 3.57.0 CWE-295

TI-2026-20321 CVE-2026-25161 · GHSA-x4q4-7phh-42j9

Alist vulnerable to Path Traversal in multiple file operation handlers

MEDIUM 42

Alist is a file list program that supports multiple storages, powered by Gin and Solidjs.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00807 Published 2026-02-04 Fixed in 3.57.0 CWE-22

TI-2023-16555 CVE-2023-33498 · GHSA-hh54-53m7-7ffj

alist <=3.16.3 is vulnerable to Incorrect Access Control.

MEDIUM 41

alist <=3.16.3 is vulnerable to Incorrect Access Control.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00737 Published 2023-06-07 No fix listed CWE-434

TI-2022-09871 CVE-2022-26533 · GHSA-jpj5-hg26-6jgc

Alist v2.1.0 and below was discovered to contain a cross-site scripting (XSS) vulnerability via /i/:data/ipa.plist.

LOW 28

Alist v2.1.0 and below was discovered to contain a cross-site scripting (XSS) vulnerability via /i/:data/ipa.plist.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00716 Published 2022-03-12 Fixed in 2.1.1 CWE-79

Open these records in search →

Critical	2
High	4
Medium	3
Low	0
No CVSS	0