GitHub Advisoryadvisory · Go

GHSA-pmg2-rph8-p8r6 Alist vulnerable to Path Traversal

CRITICAL Published 2022-12-16 Modified 2025-04-23 Official page ↗
Aliases
CVE-2022-45969
Ecosystem
Go
Packages
github.com/alist-org/alist/v3
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-22
Reviewed
2022-12-16

Affected packages

• Go github.com/alist-org/alist/v3: < 3.6.0 → fixed in 3.6.0

Description

In versions of Alist prior to 3.6.0, a user with only file upload permission can bypass the base path restriction by using '... /' to bypass the base path restriction and upload files to an arbitrary path.

Related

Alias · CVE (1)

  • CVE-2022-45969 Alist v3.4.0 is vulnerable to Directory Traversal, vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References