Skip to content
Heist/ feed
Back to feed
Critical

Alist has Insecure TLS Config

Type: advisorySources: OSV

Alist is a file list program that supports multiple storages, powered by Gin and Solidjs. Prior to version 3.57.0, the application disables TLS certificate verification by default for all outgoing storage driver communications, making the system vulnerable to Man-in-the-Middle (MitM) attacks. This enables the complete decryption, theft, and manipulation of all data transmitted during storage operations, severely compromising the confidentiality and integrity of user data. This issue has been patched in version 3.57.0.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-25160
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 00:56 UTC · Revision 1

Source evidence

Alist has Insecure TLS Config

core-osv · Original source

Published 4 Feb 2026, 19:40 UTC

Alist is a file list program that supports multiple storages, powered by Gin and Solidjs. Prior to version 3.57.0, the application disables TLS certificate verification by default for all outgoing storage driver communications, making the system vulnerable to Man-in-the-Middle (MitM) attacks. This enables the complete decryption, theft, and manipulation of all data transmitted during storage operations, severely compromising the confidentiality and integrity of user data. This issue has been patched in version 3.57.0.

osv:CVE-2026-25160
Complete source record
{
  "id": "c5af84ff6658196a4476e1a3183db61584e8af68f061bac424fa6c6c7eb4ca49",
  "url": "https://osv.dev/vulnerability/CVE-2026-25160",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Alist has Insecure TLS Config",
    "summary": "Alist is a file list program that supports multiple storages, powered by Gin and Solidjs. Prior to version 3.57.0, the application disables TLS certificate verification by default for all outgoing storage driver communications, making the system vulnerable to Man-in-the-Middle (MitM) attacks. This enables the complete decryption, theft, and manipulation of all data transmitted during storage operations, severely compromising the confidentiality and integrity of user data. This issue has been patched in version 3.57.0.",
    "evidence": "osv:CVE-2026-25160",
    "products": [],
    "severity": "critical",
    "structured": {
      "id": "CVE-2026-25160",
      "aliases": [
        "CVE-2026-25160",
        "GHSA-8jmm-3xwx-w974",
        "GO-2026-4414"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/alistgo/alist",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "84ce6728cb2b1d7c3bec475cae8095dd8968757e"
                },
                {
                  "fixed": "69629ca76a8f2c8c973ede3b616f93aa26ff23fb"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:alistgo:alist:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "3.57.0"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "69629ca76a8f2c8c973ede3b616f93aa26ff23fb"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v3.56.0",
            "v3.55.0",
            "v3.54.0",
            "v3.53.0",
            "v3.52.0",
            "v3.51.0",
            "v3.50.0",
            "v3.49.0",
            "v3.48.0",
            "v3.47.1",
            "v3.47.0",
            "v3.46.2",
            "v3.46.0",
            "v3.46.1",
            "v3.45.1",
            "v3.45.0",
            "v3.44.0",
            "v3.43.0",
            "v3.42.0",
            "v3.41.0",
            "v3.40.0",
            "v3.39.4",
            "v3.39.3",
            "v3.39.2",
            "v3.39.1",
            "v3.38.0",
            "v3.37.4",
            "v3.37.3",
            "v3.37.2",
            "v3.37.1",
            "v3.36.0",
            "v3.35.0",
            "v3.34.0",
            "v3.33.0",
            "v3.32.0",
            "v3.31.0",
            "v3.30.0",
            "v3.29.1",
            "v3.29.0",
            "v3.28.0",
            "v3.27.0",
            "v3.26.0",
            "v3.25.1",
            "v3.24.0",
            "v3.23.0",
            "v3.22.1",
            "v3.22.0",
            "v3.21.0",
            "v3.20.1",
            "v3.20.0",
            "v3.19.0",
            "v3.18.0",
            "v3.17.0",
            "v3.16.3",
            "v3.16.2",
            "v3.16.1",
            "v3.16.0",
            "v3.15.1",
            "v3.15.0",
            "v3.14.0",
            "v3.13.2",
            "v3.13.1",
            "v3.12.2",
            "v3.12.1",
            "v3.12.0",
            "v3.11.0",
            "v3.10.1",
            "v3.9.2",
            "v3.9.1",
            "v3.9.0",
            "v3.8.0",
            "v3.7.2",
            "v3.7.1",
            "v3.6.0",
            "v3.5.1",
            "v3.4.0",
            "v3.3.0",
            "v3.2.1",
            "v3.2.0",
            "v3.1.0",
            "v3.0.3",
            "v3.0.2",
            "v3.0.1",
            "v3.0.0-rc.1",
            "v3.0.0-rc.0",
            "v3.0.0-beta.2",
            "v3.0.0-beta.1",
            "v3.0.0-beta.0",
            "v2.6.1",
            "v2.6.0",
            "v2.5.2",
            "v2.5.1",
            "v2.5.0",
            "v2.4.3",
            "v2.4.2",
            "v2.4.1",
            "v2.4.0",
            "v2.3.2",
            "v2.3.1",
            "v2.3.0",
            "v2.2.0",
            "v2.1.3",
            "v2.1.2",
            "v2.1.1",
            "v2.1.0",
            "v2.0.10",
            "v2.0.9",
            "v2.0.8",
            "v2.0.7",
            "v2.0.6",
            "v2.0.5-libc",
            "v2.0.5",
            "v2.0.4-fix2",
            "v2.0.4-fix",
            "v2.0.4",
            "v2.0.3",
            "v2.0.2",
            "v2.0.1",
            "v2.0.0",
            "v2.0.0-beta7",
            "v2.0.0-beta6",
            "v2.0.0-beta5",
            "v2.0.0-beta4",
            "v2.0.0-beta3",
            "v2.0.0-beta2",
            "v2.0.0-beta"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25160.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:32.438844906Z",
      "provider": "osv",
      "references": [
        "https://github.com/AlistGo/alist/security/advisories/GHSA-8jmm-3xwx-w974",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25160.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-25160",
        "https://github.com/AlistGo/alist/commit/69629ca76a8f2c8c973ede3b616f93aa26ff23fb"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-295"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25160.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-25160",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 499383,
  "published_at": "2026-02-04T19:40:01.243+00:00"
}