CVE-2026-25160

CriticalPublic PoC

Published: 04 February 2026

Published

04 February 2026

Modified

13 February 2026

KEV Added

—

Patch

—

CVSS Score 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS Score 0.0001 1.9th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-25160 is a critical-severity Improper Certificate Validation (CWE-295) vulnerability in Alistgo Alist. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Adversary-in-the-Middle (T1557); ranked at the 1.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SC-17 (Public Key Infrastructure Certificates) and SC-23 (Session Authenticity).

Threat & Defense at a Glance

What attackers do: exploitation maps to Adversary-in-the-Middle (T1557). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SC-17 Public Key Infrastructure Certificates good match

prevent

Requires validation of public key infrastructure certificates, directly addressing the improper TLS certificate validation that enables MitM attacks in Alist storage communications.

SC-8 Transmission Confidentiality and Integrity good match

prevent

Mandates cryptographic protection for transmission confidentiality and integrity, necessitating proper TLS certificate verification to prevent data decryption, theft, and manipulation via MitM.

SC-23 Session Authenticity good match

prevent

Ensures authenticity of communications sessions, mitigating man-in-the-middle attacks resulting from disabled TLS certificate verification in outgoing storage driver connections.

MITRE ATT&CK Enterprise TechniquesAI

T1557 Adversary-in-the-Middle Credential Access

Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.

attack.mitre.org →

Why these techniques?

Disabled TLS certificate verification directly enables successful MitM interception and manipulation of storage traffic, mapping to Adversary-in-the-Middle.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Alist is a file list program that supports multiple storages, powered by Gin and Solidjs. Prior to version 3.57.0, the application disables TLS certificate verification by default for all outgoing storage driver communications, making the system vulnerable to Man-in-the-Middle (MitM)…

attacks. This enables the complete decryption, theft, and manipulation of all data transmitted during storage operations, severely compromising the confidentiality and integrity of user data. This issue has been patched in version 3.57.0.

Deeper analysisAI

Alist, a file list program that supports multiple storages and is powered by Gin and Solidjs, is affected by CVE-2026-25160 in versions prior to 3.57.0. The vulnerability stems from the application disabling TLS certificate verification by default for all outgoing storage driver communications. Classified as CWE-295 (Improper Certificate Validation), this flaw has a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating critical severity due to its potential for high impacts on confidentiality and integrity.

A network-based attacker with no privileges or user interaction required can exploit this vulnerability by performing man-in-the-middle (MitM) attacks on communications between Alist and remote storage providers. Successful exploitation enables complete decryption, theft, and manipulation of all data transmitted during storage operations, severely compromising the confidentiality and integrity of user data.

The vulnerability has been patched in Alist version 3.57.0. Mitigation involves upgrading to this version or later. Additional details are available in the GitHub security advisory at https://github.com/AlistGo/alist/security/advisories/GHSA-8jmm-3xwx-w974 and the patching commit at https://github.com/AlistGo/alist/commit/69629ca76a8f2c8c973ede3b616f93aa26ff23fb.