Is CVE-2026-25160 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-25160 being exploited in the wild.

How severe is CVE-2026-25160?

Critical severity, with a CVSS score of 9.1, published 4 February 2026.

Which products and versions are affected?

AlistGo Alist < 3.57.0; github.com/alist-org/alist (Go) SEMVER:introduced=0; github.com/alist-org/alist/v3 (Go) < 3.57.0, SEMVER:introduced=0,fixed=3.57.0.

Is there a fix for CVE-2026-25160?

Yes. github.com/alist-org/alist/v3 (Go): upgrade to 3.57.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-25160 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-25160?

Check whether you run AlistGo Alist, github.com/alist-org/alist (Go) or github.com/alist-org/alist/v3 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-25160: AlistGo Alist improper certificate validation in storage drivers

Q: Which products and versions are affected?

AlistGo Alist < 3.57.0; github.com/alist-org/alist (Go) SEMVER:introduced=0; github.com/alist-org/alist/v3 (Go) < 3.57.0, SEMVER:introduced=0,fixed=3.57.0.

Q: Is there a fix for CVE-2026-25160?

Yes. github.com/alist-org/alist/v3 (Go): upgrade to 3.57.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-25160 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-25160?

Check whether you run AlistGo Alist, github.com/alist-org/alist (Go) or github.com/alist-org/alist/v3 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-25160 · Severity: critical · CVSS 9.1 · Published 2026-02-04

Alist, a file list program that supports multiple storage providers, contains a security flaw where it fails to verify the identity of servers it connects to. This allows an attacker on the same network to intercept, read, and modify sensitive data, including login credentials and stored files. This could lead to a complete compromise of user data and unauthorized access to connected cloud storage accounts.

Technologies: github.com/alist-org/alist (Go), github.com/alist-org/alist/v3 (Go). Vendors: Go.

Quick answers

Is CVE-2026-25160 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-25160 being exploited in the wild.
How severe is CVE-2026-25160?: Critical severity, with a CVSS score of 9.1, published 4 February 2026.
Which products and versions are affected?: AlistGo Alist < 3.57.0; github.com/alist-org/alist (Go) SEMVER:introduced=0; github.com/alist-org/alist/v3 (Go) < 3.57.0, SEMVER:introduced=0,fixed=3.57.0.
Is there a fix for CVE-2026-25160?: Yes. github.com/alist-org/alist/v3 (Go): upgrade to 3.57.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-25160 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-25160?: Check whether you run AlistGo Alist, github.com/alist-org/alist (Go) or github.com/alist-org/alist/v3 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/alist-org/alist/v3 (Go): upgrade to 3.57.0 or later
```
go get github.com/alist-org/alist/v3@v3.57.0
```

Technical details

Alist is vulnerable to improper certificate validation (CWE-295) because the `TlsInsecureSkipVerify` setting is hardcoded to `true` in the `DefaultConfig()` function within `internal/conf/config.go`. This configuration causes the application to skip TLS certificate verification for all outgoing storage driver communications. A network-positioned attacker can exploit this via DNS hijacking, ARP spoofing, or rogue access points to intercept traffic. Successful exploitation allows for the decryption of TLS traffic, enabling the theft of authentication cookies and the manipulation of data transmitted between Alist and backend storage providers. The issue is fixed in version 3.57.0.

Affected products

AlistGo alist < 3.57.0

Identifiers

CVE-2026-25160
GHSA-8jmm-3xwx-w974
GO-2026-4414

Timeline

2026-02-04: disclosed
2026-02-04: advisory
2026-02-04: patched: Fixed in version 3.57.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.