Disclosure summary
### Summary The application contains a Path Traversal vulnerability (CWE-22) in multiple file operation handlers. An authenticated attacker can bypass directory-level authorisation by injecting traversal sequences into filename components, enabling unauthorised file removal, movement and copying across user boundaries within the same storage mount. ### Details The application contains a Path Traversal vulnerability (CWE-22) in multiple file operation handlers ([server/handles/fsmanage.go](https://github.com/AlistGo/alist/blob/main/server/handles/fsmanage.go), [server/handles/fsbatch.go](https://github.com/AlistGo/alist/blob/main/server/handles/fsbatch.go), etc.). Filename components in `req.Names`, `renameObject.SrcName`, and `renameObject.NewName` are directly concatenated with validated directories using `stdpath.Join()` or `fmt.Sprintf()`. This allows ".." sequences to bypass path restrictions, enabling users to access other users' files within the same storage mount and perform unauthorized actions such as deletion, renaming, or copying of files. [FsRemove](https://github.com/AlistGo/alist/blob/b4d9beb49cba399842a54fcc33bc95a4a09b7bd4/server/handles/fsmanage.go#L253-L254): ~~~g
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
GitHub Reviewed Security Advisories · GHSA-x4q4-7phh-42j9
Open original source · Updated Oct 08, 2026
Alist vulnerable to Path Traversal in multiple file operation handlers
Source severity: HIGH / 0
| Ecosystem | Package | Affected range | First patched |
|---|---|---|---|
| go | github.com/alist-org/alist/v3 | < 3.57.0 | 3.57.0 |
Original records & references
- NIST NVD record
- CVE Program record
- github.com — Reviewed advisory
PUBLISHED 2026-02-04T13:52:23-05:00
MODIFIED 2026-10-08T09:41:25-04:00
INGESTED 2026-10-08T12:30:44-04:00