CVE-2026-25160

CVE-2026-25160 is a critical vulnerability affecting Alist, a file list program, prior to version 3.57.0. It stems from the application disabling TLS certificate verification by default for all outgoing storage driver communications, making it susceptible to Man-in-the-Middle (MitM) attacks. This allows for the complete decryption, theft, and manipulation of user data, severely compromising confidentiality and integrity. Rated with a CVSS score of 7.4 (HIGH), this vulnerability has a network attack vector and high impact on confidentiality and integrity, though it requires high attack complexity. The EPSS score is low, indicating a low probability of exploitation in the wild. There is currently no evidence of active exploitation, nor is exploit code publicly available on platforms like Metasploit or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting low public awareness at this time.