CVE-2022-45968: 
NixOS vulnerability analysis and mitigation

Alist v3.4.0 contains a file upload vulnerability (CVE-2022-45968) that was discovered on November 22, 2022. The vulnerability allows users with only file upload permissions to upload files to any folder, including password-protected directories, effectively bypassing access controls (NVD, GitHub Issue).

The vulnerability exists in the file upload functionality where a user with limited upload permissions can manipulate the File-Path parameter in the upload request to specify any target directory, including password-protected ones. The issue has a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) (NVD).

This vulnerability allows authenticated users with minimal permissions to bypass directory access controls and upload files to any location within the system, including password-protected directories. This could lead to unauthorized access to sensitive directories and potential compromise of protected content (NVD, GitHub Issue).

The vulnerability is easily exploitable by authenticated users with basic file upload permissions. An attacker can intercept the upload request and modify the File-Path parameter to target any directory, including password-protected ones. Proof of concept exploit code and detailed reproduction steps have been publicly documented (GitHub Issue).

Users should upgrade to a version newer than Alist v3.4.0 that contains fixes for this vulnerability. The issue was reported and tracked through the project's GitHub repository (GitHub Issue).