CVE-2026-25161

HighPublic PoC

Published: 04 February 2026

Published

04 February 2026

Modified

13 February 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0003 8.7th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-25161 is a high-severity Path Traversal (CWE-22) vulnerability in Alistgo Alist. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data Destruction (T1485); ranked at the 8.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Data Destruction (T1485) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly prevents path traversal attacks by validating filename components in file operation handlers to reject traversal sequences like '../'.

AC-3 Access Enforcement good match

prevent

Enforces approved directory-level access authorizations, blocking authenticated attackers from unauthorized file removal, movement, or copying across user boundaries.

SI-9 Information Input Restrictions partial match

prevent

Restricts information inputs to file handlers by limiting special characters and sequences that enable path traversal bypasses.

MITRE ATT&CK Enterprise TechniquesAI

T1485 Data Destruction Impact

Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.

attack.mitre.org →

T1070.004 File Deletion Stealth

Adversaries may delete files left behind by the actions of their intrusion activity.

attack.mitre.org →

T1565.001 Stored Data Manipulation Impact

Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.

attack.mitre.org →

Why these techniques?

Path traversal directly enables unauthorized file removal (maps to Data Destruction and Indicator Removal via File Deletion) plus movement/copying across boundaries (maps to Stored Data Manipulation).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

Alist is a file list program that supports multiple storages, powered by Gin and Solidjs. Prior to version 3.57.0, the application contains path traversal vulnerability in multiple file operation handlers. An authenticated attacker can bypass directory-level authorisation by injecting traversal…

sequences into filename components, enabling unauthorised file removal, movement and copying across user boundaries within the same storage mount. This issue has been patched in version 3.57.0.

Deeper analysisAI

CVE-2026-25161 is a path traversal vulnerability (CWE-22) in Alist, a file list program that supports multiple storages and is powered by Gin and Solidjs. The flaw affects multiple file operation handlers in versions prior to 3.57.0, allowing attackers to bypass directory-level authorization by injecting traversal sequences into filename components.

An authenticated attacker with low privileges (PR:L) can exploit this vulnerability over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N). Successful exploitation enables unauthorized file removal, movement, and copying across user boundaries within the same storage mount, resulting in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H). The CVSS v3.1 base score is 8.8 (S:U).

The issue has been addressed in Alist version 3.57.0. Additional details are available in the GitHub security advisory at https://github.com/AlistGo/alist/security/advisories/GHSA-x4q4-7phh-42j9 and the patching commit at https://github.com/AlistGo/alist/commit/b188288525b9a35c76535139311e7c036dab057e.