CVE-2026-25160
Published: 04 February 2026
Summary
CVE-2026-25160 is a critical-severity Improper Certificate Validation (CWE-295) vulnerability in Alistgo Alist. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Adversary-in-the-Middle (T1557); ranked at the 14.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-17 (Public Key Infrastructure Certificates) and SC-23 (Session Authenticity).
Deeper analysis
Alist, a file list program that supports multiple storages and is powered by Gin and Solidjs, is affected by CVE-2026-25160 in versions prior to 3.57.0. The vulnerability stems from the application disabling TLS certificate verification by default for all outgoing storage driver communications. Classified as CWE-295 (Improper Certificate Validation), this flaw has a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating critical severity due to its potential for high impacts on confidentiality and integrity.
A network-based attacker with no privileges or user interaction required can exploit this vulnerability by performing man-in-the-middle (MitM) attacks on communications between Alist and remote storage providers. Successful exploitation enables complete decryption, theft, and manipulation of all data transmitted during storage operations, severely compromising the confidentiality and integrity of user data.
The vulnerability has been patched in Alist version 3.57.0. Mitigation involves upgrading to this version or later. Additional details are available in the GitHub security advisory at https://github.com/AlistGo/alist/security/advisories/GHSA-8jmm-3xwx-w974 and the patching commit at https://github.com/AlistGo/alist/commit/69629ca76a8f2c8c973ede3b616f93aa26ff23fb.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5367
Vulnerability details
Alist is a file list program that supports multiple storages, powered by Gin and Solidjs. Prior to version 3.57.0, the application disables TLS certificate verification by default for all outgoing storage driver communications, making the system vulnerable to Man-in-the-Middle (MitM)…
more
attacks. This enables the complete decryption, theft, and manipulation of all data transmitted during storage operations, severely compromising the confidentiality and integrity of user data. This issue has been patched in version 3.57.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Disabled TLS certificate verification directly enables successful MitM interception and manipulation of storage traffic, mapping to Adversary-in-the-Middle.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of public key infrastructure certificates, directly addressing the improper TLS certificate validation that enables MitM attacks in Alist storage communications.
Mandates cryptographic protection for transmission confidentiality and integrity, necessitating proper TLS certificate verification to prevent data decryption, theft, and manipulation via MitM.
Ensures authenticity of communications sessions, mitigating man-in-the-middle attacks resulting from disabled TLS certificate verification in outgoing storage driver connections.