Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The application contains a Path Traversal vulnerability (CWE-22) in multiple file operation handlers. An authenticated attacker can bypass directory-level authorisation by injecting traversal sequences into filename components, enabling unauthorised file removal, movement and copying across user boundaries within the same storage mount. Details The application contains a Path Traversal vulnerability (CWE-22) in multiple file operation handlers (server/handles/fsmanage.go, server/handles/fsbatch.go, etc.). Filename components in req.Names, renameObject.SrcName, and renameObject.NewName are directly concatenated with validated directories using stdpath.Join() or fmt.Sprintf(). This allows ".." sequences to bypass path restrictions, enabling users to access other users' files within the same storage mount and perform unauthorized actions such as deletion, renaming, or copying of files. FsRemove: ~~~go func FsRemove(c gin.Context) { // ... for , name := range req.Names { err :=…
Recommended action: Upgrade to 3.57.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The application disables TLS certificate verification by default for all outgoing storage driver communications, making the system vulnerable to Man-in-the-Middle (MitM) attacks. This enables the complete decryption, theft, and manipulation of all data transmitted during storage operations, severely compromising the confidentiality and integrity of user data. Details Certificate verification is disabled by default for all storage driver communications. The TlsInsecureSkipVerify setting is default to true in the DefaultConfig() function in internal/conf/config.go. ~~~go func DefaultConfig() Config { // ... TlsInsecureSkipVerify: true, // ... } ~~~ This vulnerability enables Man-in-the-Middle (MitM) attacks by disabling TLS certificate verification, allowing attackers to intercept and manipulate all storage communications. Attackers can exploit this through network-level attacks like ARP spoofing, rogue Wi-Fi access points, or compromised internal network equipment to redirect…
Recommended action: Upgrade to 3.57.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
AList is a file list program that supports multiple storages. AList contains a reflected cross-site scripting vulnerability in helper.go. The endpoint /i/:linkname takes in a user-provided value and reflects it back in the response. The endpoint returns an application/xml response, opening it up to HTML tags via XHTML and thus leading to a XSS vulnerability. This vulnerability is fixed in 3.29.0.
Recommended action: Upgrade to 3.29.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In versions of Alist prior to 3.6.0, a user with only file upload permission can bypass the base path restriction by using '... /' to bypass the base path restriction and upload files to an arbitrary path.
Recommended action: Upgrade to 3.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Alist v3.4.0 is vulnerable to File Upload. A user with only file upload permission can upload any file to any folder (even a password protected one). Version 3.5.1 contains a patch.
Recommended action: Upgrade to 3.5.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.