AList turns several storage providers into a single web file listing and WebDAV endpoint. That design is useful for consolidated access, but it makes the product page a poor proxy for the data boundary. The important objects are the mounted storage, the guest policy, and the permissions attached to each user.
The AList documentation describes local and remote storage mounts, WebDAV support, user-specific paths, and granular permissions. It also explains that guest access may be disabled to protect the instance. A deployment that blocks guests can still expose a large authenticated file tree. A deployment that permits guests can expose more than a title query can reveal.
A large matching population
A live ZoomEye SDK query for app="AList" returned 180,266 matches on 2026-11-01 at sub_type=all, page 1, and pagesize 1. The title="AList" query returned 180,304. The close counts suggest that many matching assets expose a product-recognizable title or fingerprint. They do not show which storage providers are mounted or which listings allow unauthenticated browsing.
A count this large is useful for prioritization, but it is not a finding about any one organization. ZoomEye is reporting internet assets that match the query, not confirmed vulnerable hosts. The analyst still needs ownership data, a login test, and a business record that ties the asset to an inventory.
Separate web and WebDAV
Check the guest setting first. If guests are allowed, list only a disposable path and verify that directory listing, download, upload, rename, and delete behave as intended. The documentation notes that WebDAV write access requires both WebDAV management and basic permissions such as rename, delete, and copy. Test the combination, not just the top-level WebDAV flag.
Inventory every storage mount, its remote identity, and the user paths that expose it. A token for a cloud drive or object store may permit more than the AList frontend shows. Check whether one mount can be aliased into another user's path and whether an old mount remains active after the employee or integration owner leaves.
Review download URLs, permalinks, and proxy routes. A file list can be protected while a direct link remains valid. Test a direct link after removing the user's access and after changing the mount policy. Cache behavior should not extend the life of a revoked link.
The review result should state the exact guest setting, the mount scope, the accounts tested, and the operations that were denied. The product count identifies a large class of control planes. The permission test explains which control plane matters.