CVE-2022-45968: Alistgo Alist

High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days.

Alist v3.4.0 is vulnerable to File Upload. A user with only file upload permission can upload any file to any folder (even a password protected one).

Affected products

• Alistgo Alist: version 3.4.0 only

Published 2022-12-12. Last modified 2026-06-17.