Alist disables TLS certificate verification for all outgoing storage driver communications before version 3.57.0, which enables attackers to perform Man‑in‑the‑Middle attacks on those connections. This allows the attacker to decrypt, steal, and manipulate the data transmitted while tunneling to storage backends, thus severely compromising confidentiality and integrity of stored user data.

The vulnerable software is Alist, a file listing application built with Gin and Solidjs, provided by the vendor AlistGo. Any deployment running a version older than 3.57.0 is affected.

The CVSS score of 9.1 indicates a high severity, and the EPSS score of less than 1% suggests a very low but non‑zero probability that exploitation will occur. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a network attacker capable of intercepting outbound TLS connections from the Alist instance to its configured storage backends – for example, by compromising an internal network segment or the cloud environment the service operates in. Since TLS certificate verification is turned off by default, the attacker can present a forged certificate and the application will accept it, enabling full MITM without any additional attacker privileges within the Alist system.