Get real-time updates on Telegram
CVE-2026-25160: github.com/alist-org/alist/v3 < 3.57.0
CVE-2026-25160 affects github.com/alist-org/alist/v3. CVSS 3.1 base score 9.1 (GitHub Advisory Database). EPSS 0.00253 (percentile 0.15484), scored 2026-10-08. Affected range: < 3.57.0. Fixed version: 3.57.0.
Affected technology
github.com/alist-org/alist/v3 · < 3.57.0
Vendor not specified by the source
Component: Not specified by the source
Function: in
Attack conditions (GitHub Advisory Database, CVSS 3.1): Network (remote) · No privileges required · No user interaction required
What an attacker can do
Attackers can exploit this through network-level attacks like ARP spoofing, rogue Wi-Fi access points, or compromised internal network equipment to redirect traffic to malicious endpoints. GitHub Advisory Database’s CVSS 3.1 assessment rates confidentiality and integrity impact as high; availability impact as none.
- Product
- github.com/alist-org/alist/v3
- CCR priority
- 36.5 /100 (P4)
- CVSS 3.1
- 9.1 /10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · GitHub Advisory Database
- EPSS
- 0.00253 · percentile 0.15484 · 2026-10-08
- KEV
- no
Provenance
- GitHub Advisory Database · Source record · observed 2026-10-08 18:27:24.781324+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-25160.html