PatchTheCVEalist vulnerabilities and fixes
Recent CVEs affecting alist, with upgrade or downgrade steps. 3 tracked.
alist has 3 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 3. Most recent: 2026-02-04. Highest priority: CVE-2026-25161 (score 50/100).
- CVE-2026-25161 HIGH 8.8 UPGRADE Alist is a file list program that supports multiple storages, powered by Gin and Solidjs
- CVE-2026-25160 CRITICAL 9.1 UPGRADE Alist is a file list program that supports multiple storages, powered by Gin and Solidjs
- CVE-2024-47067 MEDIUM 6.1 UPGRADE AList is a file list program that supports multiple storages
FAQ
How do I fix alist vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is alist being exploited right now?
None of the tracked alist CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which alist CVE should I patch first?
CVE-2026-25161 currently ranks highest (50/100): Alist is a file list program that supports multiple storages, powered by Gin and Solidjs.