https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 13 Nov 2026 13:57:50 +0000 https://db.gcve.eu/vuln/ghsa-6h3m-pw73-74r6 <p>Zipline through 4.4.0 contains a path traversal vulnerability in the PATCH /api/user/files/:id rename endpoint that allows authenticated users to overwrite existing uploads by supplying unsanitized names. Attackers can submit names like ../uploads/victim.txt that bypass the raw-string database uniqueness check but normalize via path.join(), causing fs.rename() to replace other files&#39; contents.</p> <p>Zipline through 4.4.0 contains a path traversal vulnerability in the PATCH /api/user/files/:id rename endpoint that allows authenticated users to overwrite existing uploads by supplying unsanitized names. Attackers can submit names like ../uploads/victim.txt that bypass the raw-string database uniqueness check but normalize via path.join(), causing fs.rename() to replace other files&#39; contents.</p> https://db.gcve.eu/vuln/ghsa-6h3m-pw73-74r6