CVE-2022-45968: AList vulnerable to Improper Preservation of Permissions

December 12, 2022

Alist v3.4.0 is vulnerable to File Upload. A user with only file upload permission can upload any file to any folder (even a password protected one).

References

github.com/advisories/GHSA-4gjr-vgfx-9qvw
github.com/alist-org/alist/commit/85e1350af82e1759ca6580895e48ab969eb566cf
github.com/alist-org/alist/issues/2444
nvd.nist.gov/vuln/detail/CVE-2022-45968

Code Behaviors & Features

Detect and mitigate CVE-2022-45968 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →