Skip to content

2026-02-04 — Alist path traversal in file-operation handlers (GHSA-x4q4-7phh-42j9)

Product: Alist (go module: github.com/alist-org/alist/v3)

Summary

A GitHub Security Advisory reports that Alist had path traversal issues across multiple file-operation handlers (remove/copy/rename/batch operations).

Why this matters

Even when you validate the directory a user is allowed to operate within, you can still lose isolation if you accept attacker-controlled file name components and then do:

  • Join(validatedDir, userSuppliedName)

…without a final canonical-path check.

In multi-tenant / multi-user storage mounts, that becomes cross-user data access or destruction.

Durable guidance

  1. Validate after join, not before

  2. Build the full path, canonicalize it (Clean + resolve symlinks if relevant), then enforce pathHasPrefix(allowedRoot, candidate).

  3. Treat “name” fields as hostile paths

  4. Reject any segment containing .., path separators, or percent-encoded separators.

  5. Prefer server-side identifiers over client-supplied paths.

  6. Beware of symlinks

  7. If the storage backend can contain symlinks, simple string prefix checks can be bypassed unless you realpath().

References