CVE-2026-25160-nvd.nist.gov-Received

Alist is a file list program that supports multiple storages, powered by Gin and Solidjs. Prior to version 3.57.0, the application disables TLS certificate veri…

Published:

3 February 2026 at 23:00:00

Alert date:

4 February 2026 at 21:03:00

Source:

nvd.nist.gov

Web Technologies, Database & Storage

Alist file list program versions prior to 3.57.0 disable TLS certificate verification by default for outgoing storage driver communications. This vulnerability makes the system susceptible to Man-in-the-Middle attacks, allowing complete decryption, theft, and manipulation of data during storage operations. The issue severely compromises confidentiality and integrity of user data transmitted through storage operations. The vulnerability has been patched in version 3.57.0.

Technical details

Mitigation steps:

Affected products:

Alist