Alist is a file list program that supports multiple storages, powered by Gin and Solidjs. Prior to version 3.57.0, the application disables TLS certificate veri…

Alist file list program versions prior to 3.57.0 disable TLS certificate verification by default for outgoing storage driver communications. This vulnerability makes the system susceptible to Man-in-the-Middle attacks, allowing complete decryption, theft, and manipulation of data during storage operations. The issue severely compromises confidentiality and integrity of user data transmitted through storage operations. The vulnerability has been patched in version 3.57.0.