CVE-2026-25161: 
NixOS vulnerability analysis and mitigation

CVE-2026-25161 is a path traversal vulnerability (CWE-22) in Alist, a multi-storage file list program built with Gin and Solidjs. It affects all versions of Alist prior to 3.57.0 and was published on February 4, 2026, by the XlabAI Team of Tencent Xuanwu Lab via GitHub's security advisory process. The flaw allows authenticated attackers to bypass directory-level authorization controls in shared storage environments, enabling unauthorized cross-user file operations. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Alist Security Advisory).

The root cause is improper path sanitization (CWE-22) in multiple file operation handlers — specifically server/handles/fsmanage.go and server/handles/fsbatch.go. Filename components from user-supplied input (req.Names, renameObject.SrcName, renameObject.NewName) are directly concatenated with validated base directories using stdpath.Join() or fmt.Sprintf() without stripping traversal sequences, allowing ../ sequences to escape the user's restricted directory. For example, in FsRemove, the code executes fs.Remove(c, stdpath.Join(reqDir, name)) where name is attacker-controlled, and in FsBatchRename, fmt.Sprintf("%s/%s", reqPath, renameObject.SrcName) is used without sanitization. Exploitation requires only a valid authenticated session with basic file operation permissions within a multi-user shared storage mount (Alist Security Advisory, GitHub Advisory).

Successful exploitation allows an authenticated attacker to read, copy, and exfiltrate files from other users' directories; delete or rename files belonging to other users; and move files across user boundaries — resulting in a complete compromise of confidentiality, integrity, and availability within the shared storage environment. The attack is limited to users sharing the same storage mount, but within that scope, all user data is potentially accessible or destructible without authorization. There is no lateral movement beyond the storage mount boundary, but sensitive data exfiltration and targeted data destruction are realistic outcomes (Alist Security Advisory, GitHub Advisory).

A proof-of-concept (PoC) is publicly available in the GitHub security advisory, demonstrating exploitation via a simple curl command targeting the /api/fs/remove endpoint with a traversal payload. There is no evidence of active in-the-wild exploitation at this time, and the vulnerability has not been added to the CISA KEV catalog. The EPSS score is approximately 0.035% (11th percentile), indicating a low but non-zero probability of exploitation in the near term (GitHub Advisory, Alist Security Advisory).

1. Reconnaissance: Identify a target Alist instance running a version prior to 3.57.0 with multiple users sharing the same storage mount (e.g., /shared). Confirm the instance is accessible over the network.
2. Authentication: Obtain a valid authenticated user account (non-guest) with basic file operation permissions (remove, rename, copy, or move). This could be a low-privileged user account.
3. Identify target path: Determine the directory structure of the shared storage mount. For example, if the attacker's base path is /shared/alice and the target is /shared/admin, craft traversal sequences accordingly.
4. Craft malicious request: Send a POST request to a vulnerable file operation endpoint with a ../ traversal sequence in the filename parameter. Example for file deletion:

curl -X POST -H "Content-Type: application/json" \
  -H "Authorization: <attacker_token>" \
  -d '{"dir":"/","names":["../admin/private.txt"]}' \
  http://<target>:5244/api/fs/remove

5. Achieve cross-user file access: The server concatenates the traversal sequence with the validated base directory without sanitization, resolving to /shared/admin/private.txt and performing the operation (deletion, copy, rename) on the target user's file without authorization.
6. Exfiltrate or destroy data: Use the copy endpoint (/api/fs/copy) similarly to copy files from other users' directories to the attacker's own directory for exfiltration, or use remove/rename to destroy or tamper with data (Alist Security Advisory, GitHub Advisory).

• Network: Unusual POST requests to /api/fs/remove, /api/fs/copy, or /api/fs/batch/rename containing ../ or URL-encoded traversal sequences (e.g., %2e%2e%2f) in JSON body parameters (names, SrcName, NewName).
• Logs: Alist access logs showing file operation requests where the dir field is / or a shallow path but the names array contains entries with ../ sequences pointing outside the authenticated user's base directory; repeated failed or successful operations on paths belonging to other users.
• File System: Unexpected deletion, renaming, or appearance of files in user directories that were not initiated by the directory owner; files from one user's directory appearing in another user's directory.
• Behavioral: A low-privileged user account performing file operations on directories outside their assigned base path; bulk file operations (multiple names in a single request) involving traversal sequences (Alist Security Advisory).

Upgrade Alist to version 3.57.0 or later, which addresses the path traversal by introducing a SecureJoin utility that validates resolved paths remain within the intended directory before performing file operations (commit b188288525b9a35c76535139311e7c036dab057e). For environments that cannot be immediately patched, restrict file operation permissions to trusted users only, isolate users into separate storage mounts rather than sharing a single mount, and monitor for suspicious file operation requests containing traversal sequences. Implementing network-level controls (e.g., WAF rules blocking ../ in API request bodies) can provide additional defense-in-depth (Alist Security Advisory, Patch Commit).

The vulnerability was discovered and reported by the XlabAI Team of Tencent Xuanwu Lab using their Atuin Automated Vulnerability Discovery Engine, and was responsibly disclosed through GitHub's security advisory process. The Hacker Wire covered the disclosure, noting the path traversal's ability to bypass authorization in shared storage environments. No significant broader community debate or vendor controversy has been observed beyond the standard advisory publication (Alist Security Advisory, The Hacker Wire).