# CVE-2026-25160: AlistGo Alist improper certificate validation in storage drivers

Source: https://junglewise.ai/threats/cve-2026-25160-alistgo-alist-improper-certificate-validation-in-storage-drivers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-04. Updated: 2026-06-23  
License: CC BY 4.0 with a link back

CVE-2026-25160 · Severity: critical · CVSS 9.1 · Published 2026-02-04

Alist, a file list program that supports multiple storage providers, contains a security flaw where it fails to verify the identity of servers it connects to. This allows an attacker on the same network to intercept, read, and modify sensitive data, including login credentials and stored files. This could lead to a complete compromise of user data and unauthorized access to connected cloud storage accounts.

Technologies: [github.com/alist-org/alist (Go)](https://junglewise.ai/threats/technologies/github-com-alist-org-alist), [github.com/alist-org/alist/v3 (Go)](https://junglewise.ai/threats/technologies/github-com-alist-org-alist-v3). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-25160 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25160 being exploited in the wild.

**How severe is CVE-2026-25160?** Critical severity, with a CVSS score of 9.1, published 4 February 2026.

**Which products and versions are affected?** AlistGo Alist < 3.57.0; github.com/alist-org/alist (Go) SEMVER:introduced=0; github.com/alist-org/alist/v3 (Go) < 3.57.0, SEMVER:introduced=0,fixed=3.57.0.

**Is there a fix for CVE-2026-25160?** Yes. github.com/alist-org/alist/v3 (Go): upgrade to 3.57.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-25160 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-25160?** Check whether you run AlistGo Alist, github.com/alist-org/alist (Go) or github.com/alist-org/alist/v3 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/alist-org/alist/v3 (Go): upgrade to 3.57.0 or later

  ```sh
  go get github.com/alist-org/alist/v3@v3.57.0
  ```


## Technical details

Alist is vulnerable to improper certificate validation (CWE-295) because the `TlsInsecureSkipVerify` setting is hardcoded to `true` in the `DefaultConfig()` function within `internal/conf/config.go`. This configuration causes the application to skip TLS certificate verification for all outgoing storage driver communications. A network-positioned attacker can exploit this via DNS hijacking, ARP spoofing, or rogue access points to intercept traffic. Successful exploitation allows for the decryption of TLS traffic, enabling the theft of authentication cookies and the manipulation of data transmitted between Alist and backend storage providers. The issue is fixed in version 3.57.0.

## Affected products

- AlistGo alist < 3.57.0

## Identifiers

- CVE-2026-25160
- GHSA-8jmm-3xwx-w974
- GO-2026-4414

## Timeline

- 2026-02-04: disclosed
- 2026-02-04: advisory
- 2026-02-04: patched: Fixed in version 3.57.0

## References

- [https://api.github.com/users/XlabAITeam](https://api.github.com/users/XlabAITeam)
- [https://github.com/XlabAITeam](https://github.com/XlabAITeam)
- [https://api.github.com/users/XlabAITeam/gists%7B/gist_id%7D](https://api.github.com/users/XlabAITeam/gists%7B/gist_id%7D)
- [https://api.github.com/users/XlabAITeam/repos](https://api.github.com/users/XlabAITeam/repos)
- [https://avatars.githubusercontent.com/u/214060066?v=4](https://avatars.githubusercontent.com/u/214060066?v=4)
- [https://api.github.com/users/XlabAITeam/events%7B/privacy%7D](https://api.github.com/users/XlabAITeam/events%7B/privacy%7D)

## Related threats

- [Alist path traversal in multiple file operation handlers](https://junglewise.ai/threats/cve-2026-25161-alist-path-traversal-in-multiple-file-operation-handlers)
- [GO-2024-3190 - Alist reflected Cross-Site Scripting vulnerability in github.com/alist-org/alist](https://junglewise.ai/threats/cve-2024-47067-alist-reflected-cross-site-scripting-vulnerability)
- [GO-2022-1161 - AList vulnerable to Improper Preservation of Permissions in github.com/alist-org/alist](https://junglewise.ai/threats/cve-2022-45968-alist-vulnerable-to-improper-preservation-of-permissions)
- [GO-2022-1171 - Alist vulnerable to Path Traversal in github.com/alist-org/alist](https://junglewise.ai/threats/cve-2022-45969-alist-vulnerable-to-path-traversal)
- [alist Incorrect Access Control vulnerability](https://junglewise.ai/threats/cve-2023-33498-alist-incorrect-access-control-vulnerability)