CVE-2026-25161: Alist Path Traversal Vulnerability

CVE-2026-25161 Overview

CVE-2026-25161 is a path traversal vulnerability affecting Alist, a popular file list program that supports multiple storage backends and is powered by Gin and Solidjs. Prior to version 3.57.0, the application fails to properly sanitize user-supplied input in multiple file operation handlers, allowing authenticated attackers to bypass directory-level authorization controls by injecting traversal sequences into filename components.

Critical Impact

Authenticated attackers can perform unauthorized file operations including removal, movement, and copying of files across user boundaries within the same storage mount, potentially leading to data loss, data theft, or privilege escalation.

Affected Products

• Alist versions prior to 3.57.0

Discovery Timeline

• 2026-02-04 - CVE-2026-25161 published to NVD
• 2026-02-05 - Last updated in NVD database

Technical Details for CVE-2026-25161

Vulnerability Analysis

This vulnerability (CWE-22: Improper Limitation of a Pathname to a Restricted Directory) exists in Alist's file operation handlers. The application accepts user-controlled filename parameters for operations such as file removal, movement, and copying. However, insufficient validation allows attackers to inject path traversal sequences (such as ../) into these filename components.

When an authenticated user submits a malicious request containing traversal sequences, the application processes the path without adequate sanitization, allowing the operation to target files outside the user's authorized directory scope. This enables unauthorized access to files belonging to other users within the same storage mount.

The vulnerability requires authentication, meaning attackers must have valid credentials to exploit this flaw. However, once authenticated, even low-privileged users can potentially access, modify, or delete files belonging to other users or administrative accounts.

Root Cause

The root cause of this vulnerability is improper input validation in the file operation handlers. The application fails to normalize and validate file paths before processing file operations, allowing directory traversal sequences to escape the intended directory boundaries. The affected code paths do not properly sanitize user-supplied filenames, enabling attackers to construct malicious paths that reference files outside their authorized scope.

Attack Vector

This vulnerability is exploitable over the network by authenticated users. An attacker with valid credentials can craft malicious API requests containing path traversal sequences in filename parameters. The attack flow involves:

1. Authenticating to the Alist application with valid credentials
2. Identifying file operation endpoints (remove, move, copy)
3. Crafting requests with traversal sequences (e.g., ../../target_file) in the filename parameter
4. Submitting the malicious request to perform unauthorized operations on files outside the attacker's directory scope

The vulnerability affects multiple file operation handlers, expanding the attack surface. Technical details and the security patch can be found in the GitHub Security Advisory and the patch commit.

Detection Methods for CVE-2026-25161

Indicators of Compromise

• API requests containing path traversal sequences such as ../, ..%2F, or ..%5C in file operation parameters
• Unexpected file deletions, movements, or copies affecting files outside user-designated directories
• Log entries showing file operations targeting paths with normalized traversal patterns
• Anomalous access patterns from authenticated users attempting to access cross-user directories

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing path traversal patterns in file operation endpoints
• Monitor application logs for file operation requests with suspicious path patterns or operations on files outside expected user directories
• Deploy runtime application self-protection (RASP) solutions to detect path traversal attempts at the application layer
• Configure SentinelOne Singularity to detect anomalous file system operations and web request patterns indicative of path traversal attacks

Monitoring Recommendations

• Enable detailed logging for all file operation API endpoints including the full request path and authenticated user context
• Set up alerts for file operations that result in access denied errors or target paths outside user boundaries
• Monitor for unusual patterns of file deletion, movement, or copying activities from individual user accounts
• Review authentication logs for accounts exhibiting reconnaissance behavior before exploitation attempts

How to Mitigate CVE-2026-25161

Immediate Actions Required

• Upgrade Alist to version 3.57.0 or later immediately
• Audit recent file operation logs for evidence of exploitation attempts
• Review file system integrity to identify any unauthorized modifications, deletions, or copies
• Consider temporarily restricting file operation functionality until patching is complete

Patch Information

The vulnerability has been addressed in Alist version 3.57.0. The patch implements proper path normalization and validation to prevent traversal sequences from escaping authorized directory boundaries. For detailed information about the fix, refer to the patch commit b188288525b9a35c76535139311e7c036dab057e and the GitHub Security Advisory.

Workarounds

• Implement network-level access controls to restrict access to the Alist application to trusted users only
• Deploy a WAF with rules to block requests containing path traversal patterns targeting file operation endpoints
• Restrict user permissions to minimum necessary privileges until the patch can be applied
• Consider isolating storage mounts to separate user data and limit the blast radius of potential exploitation

# Upgrade Alist to patched version
# Using Docker:
docker pull xhofe/alist:v3.57.0
docker stop alist
docker rm alist
docker run -d --name alist -v /path/to/data:/opt/alist/data -p 5244:5244 xhofe/alist:v3.57.0

# Using binary release:
# Download the latest release from https://github.com/AlistGo/alist/releases/tag/v3.57.0
# Replace existing binary and restart the service