GHSA-pmg2-rph8-p8r6

Suggest an improvement
Source
https://github.com/advisories/GHSA-pmg2-rph8-p8r6
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-pmg2-rph8-p8r6/GHSA-pmg2-rph8-p8r6.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-pmg2-rph8-p8r6
Aliases
Published
2022-12-16T00:30:44Z
Modified
2023-11-08T04:10:54.552197Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Alist vulnerable to Path Traversal
Details

In versions of Alist prior to 3.6.0, a user with only file upload permission can bypass the base path restriction by using '... /' to bypass the base path restriction and upload files to an arbitrary path.

References

Affected packages

Go / github.com/alist-org/alist/v3

Package

Name
github.com/alist-org/alist/v3
View open source insights on deps.dev
Purl
pkg:golang/github.com/alist-org/alist/v3

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.6.0