critical9.8
CVE-2022-45969
Alist vulnerable to Path Traversal
Impact
In versions of Alist prior to 3.6.0, a user with only file upload permission can bypass the base path restriction by using '... /' to bypass the base path restriction and upload files to an arbitrary path.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/alist-org/alist/v3 | < 3.6.0 | 3.6.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Alistgo | Alist | Version 3.4.0 |