CVE-2026-25160: Alist Information Disclosure Vulnerability

CVE-2026-25160 Overview

CVE-2026-25160 is a critical Certificate Validation Bypass vulnerability affecting Alist, a file list program that supports multiple storages, powered by Gin and Solidjs. Prior to version 3.57.0, the application disables TLS certificate verification by default for all outgoing storage driver communications, making the system vulnerable to Man-in-the-Middle (MitM) attacks. This enables the complete decryption, theft, and manipulation of all data transmitted during storage operations, severely compromising the confidentiality and integrity of user data.

Critical Impact

This vulnerability allows attackers to intercept, decrypt, and modify all data transmitted between Alist and connected storage backends, leading to complete compromise of user data confidentiality and integrity.

Affected Products

• Alist versions prior to 3.57.0
• WebDAV storage driver component
• All storage driver communications using TLS

Discovery Timeline

• 2026-02-04 - CVE CVE-2026-25160 published to NVD
• 2026-02-05 - Last updated in NVD database

Technical Details for CVE-2026-25160

Vulnerability Analysis

This vulnerability stems from CWE-295 (Improper Certificate Validation), where the Alist application was configured to skip TLS certificate verification by default in its storage driver communications. When TLS certificate verification is disabled, the application blindly trusts any certificate presented during the TLS handshake, including self-signed, expired, or maliciously crafted certificates. This fundamentally breaks the trust model that TLS provides, leaving users exposed to network-based attacks.

The impact is severe for environments where Alist connects to remote storage backends over untrusted networks. An attacker positioned on the network path between Alist and the storage backend can present their own certificate, establish separate TLS connections with both endpoints, and relay traffic while having full visibility into the plaintext data.

Root Cause

The root cause of this vulnerability lies in the default configuration of the TlsInsecureSkipVerify setting within the WebDAV driver metadata. The field was set with a default value that disabled certificate verification, meaning users who did not explicitly override this setting were automatically exposed to MitM attacks. This represents a dangerous "insecure by default" design pattern that violates secure development principles.

Attack Vector

The attack vector requires network access between the Alist server and its configured storage backends. An attacker performing a Man-in-the-Middle attack can:

1. Intercept the TLS handshake between Alist and the storage backend
2. Present a fraudulent certificate that Alist will accept without validation
3. Establish separate encrypted connections to both Alist and the storage backend
4. Decrypt, inspect, modify, and re-encrypt all traffic passing through

The following patch shows the security fix that removes the insecure skip verify option from the driver metadata:

 	Username string `json:"username" required:"true"`
 	Password string `json:"password" required:"true"`
 	driver.RootPath
-	TlsInsecureSkipVerify bool `json:"tls_insecure_skip_verify" default:"false"`
 }
 
 var config = driver.Config{

Source: GitHub Commit Details

The fix also updated the utility module to properly integrate with the application's configuration framework:

 	"net/http/cookiejar"
 
 	"github.com/alist-org/alist/v3/drivers/webdav/odrvcookie"
+	"github.com/alist-org/alist/v3/internal/conf"
 	"github.com/alist-org/alist/v3/internal/model"
 	"github.com/alist-org/alist/v3/pkg/gowebdav"
)

Source: GitHub Commit Details

Detection Methods for CVE-2026-25160

Indicators of Compromise

• Unexpected certificate warnings or errors in storage driver logs that were previously suppressed
• Network traffic analysis showing TLS connections established with invalid or untrusted certificates
• Anomalous data modifications or corruption in files synced through storage backends
• Evidence of ARP spoofing or DNS poisoning on the network segment between Alist and storage backends

Detection Strategies

• Review Alist configuration files for the presence of tls_insecure_skip_verify settings
• Audit network traffic between Alist instances and storage backends for certificate anomalies
• Implement network intrusion detection rules to identify potential MitM attack patterns
• Monitor for unauthorized certificate authorities in the trust chain during storage operations

Monitoring Recommendations

• Enable verbose TLS logging to capture certificate validation events
• Deploy network monitoring solutions to detect ARP spoofing and suspicious certificate presentations
• Implement certificate pinning validation checks where supported
• Review storage backend access logs for connections from unexpected IP addresses

How to Mitigate CVE-2026-25160

Immediate Actions Required

• Upgrade Alist to version 3.57.0 or later immediately
• Audit all existing Alist configurations to identify and remove any tls_insecure_skip_verify settings
• Review storage driver configurations to ensure TLS certificate verification is enabled
• Inspect network infrastructure between Alist and storage backends for signs of compromise

Patch Information

This vulnerability has been patched in Alist version 3.57.0. The fix removes the insecure default configuration option and enforces proper TLS certificate validation for all storage driver communications. Organizations should upgrade to version 3.57.0 or later as soon as possible. For detailed patch information, see the GitHub Security Advisory GHSA-8jmm-3xwx-w974 and the GitHub Commit Details.

Workarounds

• Deploy Alist and storage backends on isolated, trusted network segments to reduce MitM exposure
• Implement network-level encryption such as VPN tunnels between Alist and remote storage backends
• Use private certificate authorities and enforce certificate validation at the network level
• Monitor and restrict network access to prevent unauthorized devices from joining critical network paths

# Verify Alist version after upgrade
./alist version

# Check for insecure TLS settings in configuration
grep -r "tls_insecure_skip_verify" /path/to/alist/config/

# Ensure configuration directory has proper permissions
chmod 600 /path/to/alist/config/*.json