alist-org/alist · Security
AList vulnerable to Improper Preservation of Permissions
- GHSA ID
- GHSA-4gjr-vgfx-9qvw
- CVE ID
- CVE-2022-45968
- Severity
- high
- Published
- Updated
- CVSS
- 8.8 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 8.8 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description
Alist v3.4.0 is vulnerable to File Upload. A user with only file upload permission can upload any file to any folder (even a password protected one). Version 3.5.1 contains a patch.
CWEs
- CWE-281 · Improper Preservation of Permissions
- CWE-434 · Unrestricted Upload of File with Dangerous Type