What is GHSA-pmg2-rph8-p8r6?

GHSA-pmg2-rph8-p8r6 is a security advisory published by GitHub Security Advisories with Critical severity. Alist vulnerable to Path Traversal

Which CVE IDs does GHSA-pmg2-rph8-p8r6 cover?

GHSA-pmg2-rph8-p8r6 covers the following CVE IDs: CVE-2022-45969. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-pmg2-rph8-p8r6?

GHSA-pmg2-rph8-p8r6 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-pmg2-rph8-p8r6?

GHSA-pmg2-rph8-p8r6 affects 1 product, including: go/github.com/alist-org/alist/v3:\u003c 3.6.0.

GHSA-pmg2-rph8-p8r6CriticalCVSS 9.8

Alist vulnerable to Path Traversal

Vendor

GitHub Security Advisories

Published

December 16, 2022

Last Modified

April 23, 2025

🔗 CVE IDs covered (1)

CVE-2022-45969 →

📋 Description

In versions of Alist prior to 3.6.0, a user with only file upload permission can bypass the base path restriction by using '... /' to bypass the base path restriction and upload files to an arbitrary path.

🎯 Affected products1

go/github.com/alist-org/alist/v3:< 3.6.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2022-45969
https://github.com/alist-org/alist/issues/2449
https://github.com/alist-org/alist/commit/b5bf5f43253175b55fa2cb511fea601e677d2d83
https://github.com/advisories/GHSA-pmg2-rph8-p8r6