Alist is vulnerable to a path traversal flaw in several file operation handlers. An attacker who has authenticated access can inject traversal sequences into filename components, which allows that attacker to bypass ordinary directory‑level authorization checks. The consequence is that the attacker can delete, move, or copy files across user boundaries within the same storage mount, effectively erasing or exfiltrating other users' data without permissions.

The vulnerability applies to AlistGo: Alist deployments running any version before 3.57.0. Versions 3.57.0 and later contain the fix and are not affected.

The CVSS score is 8.8, indicating a high severity. The EPSS score is below 1 %, showing that exploitation likelihood is currently low but not nonexistent, and the flaw is not yet listed in CISA’s KEV catalog. Exploitation requires a legitimate authenticated session; with such access the attacker can craft file names containing traversal sequences and execute dele‑, move‑, or copy‑type operations, thereby compromising data integrity and potentially confidentiality across users.