Search
Find a vulnerability
Search criteria
54 vulnerabilities by diced
CVE-2026-126952 (GCVE-0-2026-126952)
Vulnerability from nvd – Published: 2026-11-13 09:34 – Updated: 2026-11-13 09:34
VLAI
EPSS
VEX
Title
Zipline through 4.4.0 WebAuthn Authentication Bypass via Passkey Login
Summary
Zipline through 4.4.0 contains an authentication bypass vulnerability in the WebAuthn login endpoint that creates sessions for a supplied registered credential ID without verifying the assertion. Attackers who obtain a target's passkey credential ID can impersonate that account without its authenticator, potentially gaining administrative control over SUPERADMIN accounts.
Severity
8.1 (High)
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/diced/zipline/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/zipline-thro… | third-party-advisory |
Date Public
2026-01-20 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "zipline",
"vendor": "diced",
"versions": [
{
"lessThanOrEqual": "4.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "nojomyth-dev"
}
],
"datePublic": "2026-01-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zipline through 4.4.0 contains an authentication bypass vulnerability in the WebAuthn login endpoint that creates sessions for a supplied registered credential ID without verifying the assertion. Attackers who obtain a target\u0027s passkey credential ID can impersonate that account without its authenticator, potentially gaining administrative control over SUPERADMIN accounts."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:34:30.285Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-8g3f-425r-35rq)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/diced/zipline/security/advisories/GHSA-8g3f-425r-35rq"
},
{
"name": "VulnCheck Advisory: Zipline through 4.4.0 WebAuthn Authentication Bypass via Passkey Login",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zipline-through-4.4.0-webauthn-authentication-bypass-via-passkey-login"
}
],
"title": "Zipline through 4.4.0 WebAuthn Authentication Bypass via Passkey Login",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-126952",
"datePublished": "2026-11-13T09:34:30.285Z",
"dateReserved": "2026-11-11T22:57:48.492Z",
"dateUpdated": "2026-11-13T09:34:30.285Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126951 (GCVE-0-2026-126951)
Vulnerability from nvd – Published: 2026-11-13 09:34 – Updated: 2026-11-13 09:34
VLAI
EPSS
VEX
Title
Zipline through 4.4.0 Authenticated Path Traversal via /api/user/files/:id/raw
Summary
Zipline through 4.4.0 contains a path traversal vulnerability that allows authenticated users to read arbitrary server files by abusing a fallback treating the :id parameter as a datasource key. Attackers can send encoded traversal sequences in the :id of GET /api/user/files/:id/raw to escape the Local datasource uploads directory and read files like /etc/shadow.
Severity
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/diced/zipline/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/zipline-thro… | third-party-advisory |
Date Public
2026-01-20 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "zipline",
"vendor": "diced",
"versions": [
{
"lessThanOrEqual": "4.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "nojomyth-dev"
}
],
"datePublic": "2026-01-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zipline through 4.4.0 contains a path traversal vulnerability that allows authenticated users to read arbitrary server files by abusing a fallback treating the :id parameter as a datasource key. Attackers can send encoded traversal sequences in the :id of GET /api/user/files/:id/raw to escape the Local datasource uploads directory and read files like /etc/shadow."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:34:30.968Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-8xjg-qm2p-75gm)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/diced/zipline/security/advisories/GHSA-8xjg-qm2p-75gm"
},
{
"name": "VulnCheck Advisory: Zipline through 4.4.0 Authenticated Path Traversal via /api/user/files/:id/raw",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zipline-through-4.4.0-authenticated-path-traversal-via-api-user-files-id-raw"
}
],
"title": "Zipline through 4.4.0 Authenticated Path Traversal via /api/user/files/:id/raw",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-126951",
"datePublished": "2026-11-13T09:34:30.968Z",
"dateReserved": "2026-11-11T22:57:48.492Z",
"dateUpdated": "2026-11-13T09:34:30.968Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126950 (GCVE-0-2026-126950)
Vulnerability from nvd – Published: 2026-11-13 09:34 – Updated: 2026-11-13 09:34
VLAI
EPSS
VEX
Title
Zipline through 4.4.0 Path Traversal Arbitrary File Delete via x-zipline-file-extension
Summary
Zipline through 4.4.0 contains a path traversal vulnerability that allows authenticated attackers to delete arbitrary server files by injecting traversal sequences via the x-zipline-file-extension header. Attackers can upload a file with a poisoned stored name and short expiry so LocalDatasource deletion removes chosen files, causing denial of service or data loss.
Severity
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/diced/zipline/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/zipline-thro… | third-party-advisory |
Date Public
2026-01-20 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "zipline",
"vendor": "diced",
"versions": [
{
"lessThanOrEqual": "4.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "nojomyth-dev"
}
],
"datePublic": "2026-01-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zipline through 4.4.0 contains a path traversal vulnerability that allows authenticated attackers to delete arbitrary server files by injecting traversal sequences via the x-zipline-file-extension header. Attackers can upload a file with a poisoned stored name and short expiry so LocalDatasource deletion removes chosen files, causing denial of service or data loss."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:34:31.656Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-2wfm-prg7-x586)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/diced/zipline/security/advisories/GHSA-2wfm-prg7-x586"
},
{
"name": "VulnCheck Advisory: Zipline through 4.4.0 Path Traversal Arbitrary File Delete via x-zipline-file-extension",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zipline-through-4.4.0-path-traversal-arbitrary-file-delete-via-x-zipline-file-extension"
}
],
"title": "Zipline through 4.4.0 Path Traversal Arbitrary File Delete via x-zipline-file-extension",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-126950",
"datePublished": "2026-11-13T09:34:31.656Z",
"dateReserved": "2026-11-11T22:57:48.492Z",
"dateUpdated": "2026-11-13T09:34:31.656Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126949 (GCVE-0-2026-126949)
Vulnerability from nvd – Published: 2026-11-13 09:34 – Updated: 2026-11-13 09:34
VLAI
EPSS
VEX
Title
Zipline through 4.4.0 Path Traversal File Overwrite via PATCH /api/user/files/:id
Summary
Zipline through 4.4.0 contains a path traversal vulnerability in the PATCH /api/user/files/:id rename endpoint that allows authenticated users to overwrite existing uploads by supplying unsanitized names. Attackers can submit names like ../uploads/victim.txt that bypass the raw-string database uniqueness check but normalize via path.join(), causing fs.rename() to replace other files' contents.
Severity
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/diced/zipline/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/zipline-thro… | third-party-advisory |
Date Public
2026-01-20 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "zipline",
"vendor": "diced",
"versions": [
{
"lessThanOrEqual": "4.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "nojomyth-dev"
}
],
"datePublic": "2026-01-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zipline through 4.4.0 contains a path traversal vulnerability in the PATCH /api/user/files/:id rename endpoint that allows authenticated users to overwrite existing uploads by supplying unsanitized names. Attackers can submit names like ../uploads/victim.txt that bypass the raw-string database uniqueness check but normalize via path.join(), causing fs.rename() to replace other files\u0027 contents."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:34:32.349Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-rw9m-7mvm-6gxp)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/diced/zipline/security/advisories/GHSA-rw9m-7mvm-6gxp"
},
{
"name": "VulnCheck Advisory: Zipline through 4.4.0 Path Traversal File Overwrite via PATCH /api/user/files/:id",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zipline-through-4.4.0-path-traversal-file-overwrite-via-patch-api-user-files-id"
}
],
"title": "Zipline through 4.4.0 Path Traversal File Overwrite via PATCH /api/user/files/:id",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-126949",
"datePublished": "2026-11-13T09:34:32.349Z",
"dateReserved": "2026-11-11T22:57:48.492Z",
"dateUpdated": "2026-11-13T09:34:32.349Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126948 (GCVE-0-2026-126948)
Vulnerability from nvd – Published: 2026-11-13 09:34 – Updated: 2026-11-13 09:34
VLAI
EPSS
VEX
Title
Zipline before 4.5.0 IDOR via Folder PATCH and DELETE Endpoints
Summary
Zipline before 4.5.0 contains an insecure direct object reference vulnerability caused by missing ownership verification in the PATCH and DELETE handlers for /api/user/folders/:id. Authenticated attackers can supply another user's folder ID to rename it, make it public, enable uploads, or delete it.
Severity
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/diced/zipline/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/zipline-befo… | third-party-advisory |
Impacted products
Date Public
2026-03-21 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/zipline",
"product": "zipline",
"vendor": "diced",
"versions": [
{
"lessThan": "4.5.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.5.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-03-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zipline before 4.5.0 contains an insecure direct object reference vulnerability caused by missing ownership verification in the PATCH and DELETE handlers for /api/user/folders/:id. Authenticated attackers can supply another user\u0027s folder ID to rename it, make it public, enable uploads, or delete it."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:34:33.024Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-fgwh-2pc5-wr73)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/diced/zipline/security/advisories/GHSA-fgwh-2pc5-wr73"
},
{
"name": "VulnCheck Advisory: Zipline before 4.5.0 IDOR via Folder PATCH and DELETE Endpoints",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zipline-before-4.5.0-idor-via-folder-patch-and-delete-endpoints"
}
],
"title": "Zipline before 4.5.0 IDOR via Folder PATCH and DELETE Endpoints",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-126948",
"datePublished": "2026-11-13T09:34:33.024Z",
"dateReserved": "2026-11-11T22:57:48.492Z",
"dateUpdated": "2026-11-13T09:34:33.024Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126947 (GCVE-0-2026-126947)
Vulnerability from nvd – Published: 2026-11-13 09:34 – Updated: 2026-11-13 09:34
VLAI
EPSS
VEX
Title
Zipline before 4.5.0 Stored Open Redirect via POST /api/user/urls
Summary
Zipline before 4.5.0 contains a stored open redirect vulnerability that allows authenticated users to set arbitrary short URL destinations by abusing missing scheme validation in POST /api/user/urls. Attackers can store javascript: URIs or attacker-controlled URLs as destinations, causing visitors of the trusted short link to be redirected to phishing or malware pages.
Severity
5.4 (Medium)
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/diced/zipline/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/zipline-befo… | third-party-advisory |
Impacted products
Date Public
2026-03-21 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "zipline",
"vendor": "diced",
"versions": [
{
"lessThan": "4.5.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.5.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Hussien-Alzaghateet"
}
],
"datePublic": "2026-03-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zipline before 4.5.0 contains a stored open redirect vulnerability that allows authenticated users to set arbitrary short URL destinations by abusing missing scheme validation in POST /api/user/urls. Attackers can store javascript: URIs or attacker-controlled URLs as destinations, causing visitors of the trusted short link to be redirected to phishing or malware pages."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:34:33.705Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-6q69-pgmp-w93c)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/diced/zipline/security/advisories/GHSA-6q69-pgmp-w93c"
},
{
"name": "VulnCheck Advisory: Zipline before 4.5.0 Stored Open Redirect via POST /api/user/urls",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zipline-before-4.5.0-stored-open-redirect-via-post-api-user-urls"
}
],
"title": "Zipline before 4.5.0 Stored Open Redirect via POST /api/user/urls",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-126947",
"datePublished": "2026-11-13T09:34:33.705Z",
"dateReserved": "2026-11-11T22:57:48.492Z",
"dateUpdated": "2026-11-13T09:34:33.705Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126946 (GCVE-0-2026-126946)
Vulnerability from nvd – Published: 2026-11-13 09:34 – Updated: 2026-11-13 09:34
VLAI
EPSS
VEX
Title
Zipline 4.3.0 before 4.5.0 Stored XSS via SSR Embed Meta Tags
Summary
Zipline from 4.3.0 before 4.5.0 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject HTML through unescaped embed settings in SSR meta tags. Attackers can set malicious embedTitle, embedDescription, embedSiteName, or embedColor values via PATCH /api/user to execute JavaScript in browsers of visitors opening their file view pages.
Severity
5.4 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/diced/zipline/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/zipline-4.3.… | third-party-advisory |
Impacted products
Date Public
2026-03-21 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "zipline",
"vendor": "diced",
"versions": [
{
"lessThan": "4.5.0",
"status": "affected",
"version": "4.3.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.5.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "kq5y"
}
],
"datePublic": "2026-03-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zipline from 4.3.0 before 4.5.0 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject HTML through unescaped embed settings in SSR meta tags. Attackers can set malicious embedTitle, embedDescription, embedSiteName, or embedColor values via PATCH /api/user to execute JavaScript in browsers of visitors opening their file view pages."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:34:34.387Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-9j96-vvqc-h9f8)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/diced/zipline/security/advisories/GHSA-9j96-vvqc-h9f8"
},
{
"name": "VulnCheck Advisory: Zipline 4.3.0 before 4.5.0 Stored XSS via SSR Embed Meta Tags",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zipline-4.3.0-before-4.5.0-stored-xss-via-ssr-embed-meta-tags"
}
],
"title": "Zipline 4.3.0 before 4.5.0 Stored XSS via SSR Embed Meta Tags",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-126946",
"datePublished": "2026-11-13T09:34:34.387Z",
"dateReserved": "2026-11-11T22:57:48.492Z",
"dateUpdated": "2026-11-13T09:34:34.387Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126945 (GCVE-0-2026-126945)
Vulnerability from nvd – Published: 2026-11-13 09:34 – Updated: 2026-11-13 09:34
VLAI
EPSS
VEX
Title
Zipline before 4.5.1 Stored XSS via HighlightCode Component
Summary
Zipline before 4.5.1 contains a stored cross-site scripting vulnerability in the HighlightCode component that renders unescaped file content before highlight.js finishes loading. Authenticated attackers can upload text files containing HTML/JavaScript payloads that execute in viewers' browsers, enabling API calls such as account changes on the victim's behalf.
Severity
8.7 (High)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/diced/zipline/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/zipline-befo… | third-party-advisory |
Impacted products
Date Public
2026-03-28 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "zipline",
"vendor": "diced",
"versions": [
{
"lessThan": "4.5.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.5.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "mtolley"
}
],
"datePublic": "2026-03-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zipline before 4.5.1 contains a stored cross-site scripting vulnerability in the HighlightCode component that renders unescaped file content before highlight.js finishes loading. Authenticated attackers can upload text files containing HTML/JavaScript payloads that execute in viewers\u0027 browsers, enabling API calls such as account changes on the victim\u0027s behalf."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:34:35.069Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-m649-gvwx-j6qv)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/diced/zipline/security/advisories/GHSA-m649-gvwx-j6qv"
},
{
"name": "VulnCheck Advisory: Zipline before 4.5.1 Stored XSS via HighlightCode Component",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zipline-before-4.5.1-stored-xss-via-highlightcode-component"
}
],
"title": "Zipline before 4.5.1 Stored XSS via HighlightCode Component",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-126945",
"datePublished": "2026-11-13T09:34:35.069Z",
"dateReserved": "2026-11-11T22:56:41.844Z",
"dateUpdated": "2026-11-13T09:34:35.069Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126944 (GCVE-0-2026-126944)
Vulnerability from nvd – Published: 2026-11-13 09:34 – Updated: 2026-11-13 09:34
VLAI
EPSS
VEX
Title
Zipline before 4.6.1 Path Traversal via Imported Filenames in LocalDatasource
Summary
Zipline before 4.6.1 contains a path traversal vulnerability in LocalDatasource that allows SUPERADMIN users to read or delete files outside the upload directory by importing records with traversal filenames. Attackers can trigger the unchecked range-read path with byte-range requests or set expired deletion times to delete files accessible to the Zipline process.
Severity
5.7 (Medium)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/diced/zipline/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/zipline-befo… | third-party-advisory |
Impacted products
Date Public
2026-05-20 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/zipline",
"product": "zipline",
"vendor": "diced",
"versions": [
{
"lessThan": "4.6.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.6.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "EndlssNightmare"
}
],
"datePublic": "2026-05-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zipline before 4.6.1 contains a path traversal vulnerability in LocalDatasource that allows SUPERADMIN users to read or delete files outside the upload directory by importing records with traversal filenames. Attackers can trigger the unchecked range-read path with byte-range requests or set expired deletion times to delete files accessible to the Zipline process."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:34:35.737Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-gr35-qcpp-65w5)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/diced/zipline/security/advisories/GHSA-gr35-qcpp-65w5"
},
{
"name": "VulnCheck Advisory: Zipline before 4.6.1 Path Traversal via Imported Filenames in LocalDatasource",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zipline-before-4.6.1-path-traversal-via-imported-filenames-in-localdatasource"
}
],
"title": "Zipline before 4.6.1 Path Traversal via Imported Filenames in LocalDatasource",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-126944",
"datePublished": "2026-11-13T09:34:35.737Z",
"dateReserved": "2026-11-11T22:56:41.844Z",
"dateUpdated": "2026-11-13T09:34:35.737Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126943 (GCVE-0-2026-126943)
Vulnerability from nvd – Published: 2026-11-13 09:34 – Updated: 2026-11-13 09:34
VLAI
EPSS
VEX
Title
Zipline 4.2.0 before 4.6.2 OAuth2 Client Secret Leakage in Startup Logs
Summary
Zipline from 4.2.0 before 4.6.2 contains an information disclosure vulnerability that logs sensitive environment variable values, such as OAUTH_OIDC_CLIENT_SECRET, without redaction at startup. Attackers with access to system journal or docker logs can obtain OAuth2 client secrets and use them to exchange intercepted OAuth2 callbacks for valid tokens.
Severity
4.9 (Medium)
CWE
- CWE-532 - Insertion of Sensitive Information into Log File
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/diced/zipline/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/zipline-4.2.… | third-party-advisory |
Impacted products
Date Public
2026-06-03 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/zipline",
"product": "zipline",
"vendor": "diced",
"versions": [
{
"lessThan": "4.6.2",
"status": "affected",
"version": "4.2.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.6.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "soopyc"
}
],
"datePublic": "2026-06-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zipline from 4.2.0 before 4.6.2 contains an information disclosure vulnerability that logs sensitive environment variable values, such as OAUTH_OIDC_CLIENT_SECRET, without redaction at startup. Attackers with access to system journal or docker logs can obtain OAuth2 client secrets and use them to exchange intercepted OAuth2 callbacks for valid tokens."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:34:36.421Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-2h25-m8rf-v86j)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/diced/zipline/security/advisories/GHSA-2h25-m8rf-v86j"
},
{
"name": "VulnCheck Advisory: Zipline 4.2.0 before 4.6.2 OAuth2 Client Secret Leakage in Startup Logs",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zipline-4.2.0-before-4.6.2-oauth2-client-secret-leakage-in-startup-logs"
}
],
"title": "Zipline 4.2.0 before 4.6.2 OAuth2 Client Secret Leakage in Startup Logs",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-126943",
"datePublished": "2026-11-13T09:34:36.421Z",
"dateReserved": "2026-11-11T22:56:41.844Z",
"dateUpdated": "2026-11-13T09:34:36.421Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126942 (GCVE-0-2026-126942)
Vulnerability from nvd – Published: 2026-11-13 09:34 – Updated: 2026-11-13 09:34
VLAI
EPSS
VEX
Title
Zipline before 4.6.2 Missing Authorization via POST /api/user/folders
Summary
Zipline before 4.6.2 contains a missing authorization vulnerability in POST /api/user/folders that allows authenticated users to reparent other users' files by supplying their file IDs. Attackers can harvest file IDs from public folders and create a folder seeded with them, disclosing victims' file URLs and removing those files from their folder views.
Severity
5.4 (Medium)
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/diced/zipline/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/zipline-befo… | third-party-advisory |
Impacted products
Date Public
2026-06-03 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/zipline",
"product": "zipline",
"vendor": "diced",
"versions": [
{
"lessThan": "4.6.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.6.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "dizconnectz"
}
],
"datePublic": "2026-06-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zipline before 4.6.2 contains a missing authorization vulnerability in POST /api/user/folders that allows authenticated users to reparent other users\u0027 files by supplying their file IDs. Attackers can harvest file IDs from public folders and create a folder seeded with them, disclosing victims\u0027 file URLs and removing those files from their folder views."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:34:37.092Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-84c9-r2mj-p9pp)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/diced/zipline/security/advisories/GHSA-84c9-r2mj-p9pp"
},
{
"name": "VulnCheck Advisory: Zipline before 4.6.2 Missing Authorization via POST /api/user/folders",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zipline-before-4.6.2-missing-authorization-via-post-api-user-folders"
}
],
"title": "Zipline before 4.6.2 Missing Authorization via POST /api/user/folders",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-126942",
"datePublished": "2026-11-13T09:34:37.092Z",
"dateReserved": "2026-11-11T22:56:41.844Z",
"dateUpdated": "2026-11-13T09:34:37.092Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126941 (GCVE-0-2026-126941)
Vulnerability from nvd – Published: 2026-11-13 09:34 – Updated: 2026-11-13 09:34
VLAI
EPSS
VEX
Title
Zipline through 4.6.2 Privilege Escalation via Missing Role Checks on User Endpoints
Summary
Zipline through 4.6.2 contains an authorization bypass vulnerability that allows authenticated administrators to read superadmin secrets because GET /api/users and GET /api/users/:id lack the canInteract check. Attackers can retrieve plaintext totpSecret and OAuth tokens to bypass 2FA and take over superadmin accounts, while any authenticated user can enumerate other users' folders via GET /api/user/folders.
Severity
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/diced/zipline/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/zipline-thro… | third-party-advisory |
Date Public
2026-06-26 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "zipline",
"vendor": "diced",
"versions": [
{
"lessThanOrEqual": "4.6.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "CyberKareem"
}
],
"datePublic": "2026-06-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zipline through 4.6.2 contains an authorization bypass vulnerability that allows authenticated administrators to read superadmin secrets because GET /api/users and GET /api/users/:id lack the canInteract check. Attackers can retrieve plaintext totpSecret and OAuth tokens to bypass 2FA and take over superadmin accounts, while any authenticated user can enumerate other users\u0027 folders via GET /api/user/folders."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:34:37.786Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-8643-cr38-p6qj)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/diced/zipline/security/advisories/GHSA-8643-cr38-p6qj"
},
{
"name": "VulnCheck Advisory: Zipline through 4.6.2 Privilege Escalation via Missing Role Checks on User Endpoints",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zipline-through-4.6.2-privilege-escalation-via-missing-role-checks-on-user-endpoints"
}
],
"title": "Zipline through 4.6.2 Privilege Escalation via Missing Role Checks on User Endpoints",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-126941",
"datePublished": "2026-11-13T09:34:37.786Z",
"dateReserved": "2026-11-11T22:56:41.844Z",
"dateUpdated": "2026-11-13T09:34:37.786Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126940 (GCVE-0-2026-126940)
Vulnerability from nvd – Published: 2026-11-13 09:34 – Updated: 2026-11-13 09:34
VLAI
EPSS
VEX
Title
Zipline before 4.6.4 Rate Limit Bypass via Query String and Header
Summary
Zipline before 4.6.4 contains a rate limit bypass vulnerability that allows remote attackers to evade request limits by varying query strings or supplying the x-zipline-p-filename header. Attackers can append differing query parameters to login and file or short-link password verification endpoints to perform credential guessing beyond the intended rate limits.
Severity
6.5 (Medium)
CWE
- CWE-307 - Improper Restriction of Excessive Authentication Attempts
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/diced/zipline/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/zipline-befo… | third-party-advisory |
Impacted products
Date Public
2026-07-06 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/zipline",
"product": "zipline",
"vendor": "diced",
"versions": [
{
"lessThan": "4.6.4",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.6.4",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "de3erve-hunter"
}
],
"datePublic": "2026-07-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zipline before 4.6.4 contains a rate limit bypass vulnerability that allows remote attackers to evade request limits by varying query strings or supplying the x-zipline-p-filename header. Attackers can append differing query parameters to login and file or short-link password verification endpoints to perform credential guessing beyond the intended rate limits."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:34:38.463Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-2qgq-hv52-jhqq)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/diced/zipline/security/advisories/GHSA-2qgq-hv52-jhqq"
},
{
"name": "VulnCheck Advisory: Zipline before 4.6.4 Rate Limit Bypass via Query String and Header",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zipline-before-4.6.4-rate-limit-bypass-via-query-string-and-header"
}
],
"title": "Zipline before 4.6.4 Rate Limit Bypass via Query String and Header",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-126940",
"datePublished": "2026-11-13T09:34:38.463Z",
"dateReserved": "2026-11-11T22:56:41.844Z",
"dateUpdated": "2026-11-13T09:34:38.463Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126939 (GCVE-0-2026-126939)
Vulnerability from nvd – Published: 2026-11-13 09:34 – Updated: 2026-11-13 09:34
VLAI
EPSS
VEX
Title
Zipline before 4.6.4 Unauthenticated File Listing via page Query Parameter
Summary
Zipline before 4.6.4 contains an information disclosure vulnerability in GET /api/server/folder/:id that allows unauthenticated attackers to list files in non-public upload-only folders. Attackers who know the folder UUID can supply the page query parameter to bypass the metadata-only early return and enumerate file names, IDs, MIME types, sizes, and view counts.
Severity
5.3 (Medium)
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/diced/zipline/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/zipline-befo… | third-party-advisory |
Impacted products
Date Public
2026-07-06 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/zipline",
"product": "zipline",
"vendor": "diced",
"versions": [
{
"lessThan": "4.6.4",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.6.4",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "de3erve-hunter"
}
],
"datePublic": "2026-07-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zipline before 4.6.4 contains an information disclosure vulnerability in GET /api/server/folder/:id that allows unauthenticated attackers to list files in non-public upload-only folders. Attackers who know the folder UUID can supply the page query parameter to bypass the metadata-only early return and enumerate file names, IDs, MIME types, sizes, and view counts."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:34:39.144Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-jh6v-w5f3-8p4x)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/diced/zipline/security/advisories/GHSA-jh6v-w5f3-8p4x"
},
{
"name": "VulnCheck Advisory: Zipline before 4.6.4 Unauthenticated File Listing via page Query Parameter",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zipline-before-4.6.4-unauthenticated-file-listing-via-page-query-parameter"
}
],
"title": "Zipline before 4.6.4 Unauthenticated File Listing via page Query Parameter",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-126939",
"datePublished": "2026-11-13T09:34:39.144Z",
"dateReserved": "2026-11-11T22:56:41.844Z",
"dateUpdated": "2026-11-13T09:34:39.144Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126938 (GCVE-0-2026-126938)
Vulnerability from nvd – Published: 2026-11-13 09:34 – Updated: 2026-11-13 09:34
VLAI
EPSS
VEX
Title
Zipline before 4.6.4 Upload Quota Bypass via Forged Content-Range Headers
Summary
Zipline before 4.6.4 contains a resource allocation vulnerability that allows authenticated users to bypass chunked-upload size and quota checks by forging Content-Range offsets and totals. Attackers can send tiny chunks to the partial upload endpoint with large declared offsets, causing the server to create oversized files and exhaust disk space.
Severity
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/diced/zipline/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/zipline-befo… | third-party-advisory |
Impacted products
Date Public
2026-07-06 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "zipline",
"vendor": "diced",
"versions": [
{
"lessThan": "4.6.4",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.6.4",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "superintendent2521"
}
],
"datePublic": "2026-07-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zipline before 4.6.4 contains a resource allocation vulnerability that allows authenticated users to bypass chunked-upload size and quota checks by forging Content-Range offsets and totals. Attackers can send tiny chunks to the partial upload endpoint with large declared offsets, causing the server to create oversized files and exhaust disk space."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:34:39.833Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-fp8p-hf8g-fw65)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/diced/zipline/security/advisories/GHSA-fp8p-hf8g-fw65"
},
{
"name": "VulnCheck Advisory: Zipline before 4.6.4 Upload Quota Bypass via Forged Content-Range Headers",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zipline-before-4.6.4-upload-quota-bypass-via-forged-content-range-headers"
}
],
"title": "Zipline before 4.6.4 Upload Quota Bypass via Forged Content-Range Headers",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-126938",
"datePublished": "2026-11-13T09:34:39.833Z",
"dateReserved": "2026-11-11T22:56:41.844Z",
"dateUpdated": "2026-11-13T09:34:39.833Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126937 (GCVE-0-2026-126937)
Vulnerability from nvd – Published: 2026-11-13 09:34 – Updated: 2026-11-13 09:34
VLAI
EPSS
VEX
Title
Zipline before 4.6.5 TOCTOU Race Condition via /api/setup
Summary
Zipline before 4.6.5 contains a TOCTOU race condition in the POST /api/setup endpoint that allows unauthenticated attackers to create multiple SUPERADMIN accounts by racing concurrent requests before the firstSetup flag is reset. Attackers can send simultaneous requests with spoofed X-Forwarded-For headers during the argon2 hashing window to gain full administrative control of the instance.
Severity
8.1 (High)
CWE
- CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/diced/zipline/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/zipline-befo… | third-party-advisory |
Impacted products
Date Public
2026-07-28 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "zipline",
"vendor": "diced",
"versions": [
{
"lessThan": "4.6.5",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.6.5",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "EQSTLab"
},
{
"lang": "en",
"type": "finder",
"value": "min8282"
}
],
"datePublic": "2026-07-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zipline before 4.6.5 contains a TOCTOU race condition in the POST /api/setup endpoint that allows unauthenticated attackers to create multiple SUPERADMIN accounts by racing concurrent requests before the firstSetup flag is reset. Attackers can send simultaneous requests with spoofed X-Forwarded-For headers during the argon2 hashing window to gain full administrative control of the instance."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "Time-of-check Time-of-use (TOCTOU) Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:34:40.499Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-wgjv-p9mm-qw77)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/diced/zipline/security/advisories/GHSA-wgjv-p9mm-qw77"
},
{
"name": "VulnCheck Advisory: Zipline before 4.6.5 TOCTOU Race Condition via /api/setup",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zipline-before-4.6.5-toctou-race-condition-via-api-setup"
}
],
"title": "Zipline before 4.6.5 TOCTOU Race Condition via /api/setup",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-126937",
"datePublished": "2026-11-13T09:34:40.499Z",
"dateReserved": "2026-11-11T22:56:41.844Z",
"dateUpdated": "2026-11-13T09:34:40.499Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126936 (GCVE-0-2026-126936)
Vulnerability from nvd – Published: 2026-11-13 09:34 – Updated: 2026-11-13 09:34
VLAI
EPSS
VEX
Title
Zipline before 4.7.0 Race Condition in Invite and Quota Limits
Summary
Zipline before 4.7.0 contains a race condition vulnerability that allows users to bypass invitation usage limits, upload storage quotas, and shortened-URL quotas through concurrent requests. Attackers can send overlapping registration, upload, or URL creation requests that pass checks against stale state, creating extra accounts and exceeding administrator-configured resource quotas.
Severity
CWE
- CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/diced/zipline/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/zipline-befo… | third-party-advisory |
Impacted products
Date Public
2026-08-16 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "zipline",
"vendor": "diced",
"versions": [
{
"lessThan": "4.7.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.7.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "tonghuaroot"
}
],
"datePublic": "2026-08-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zipline before 4.7.0 contains a race condition vulnerability that allows users to bypass invitation usage limits, upload storage quotas, and shortened-URL quotas through concurrent requests. Attackers can send overlapping registration, upload, or URL creation requests that pass checks against stale state, creating extra accounts and exceeding administrator-configured resource quotas."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "Time-of-check Time-of-use (TOCTOU) Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:34:41.165Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-wq7g-g9f8-8q2p)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/diced/zipline/security/advisories/GHSA-wq7g-g9f8-8q2p"
},
{
"name": "VulnCheck Advisory: Zipline before 4.7.0 Race Condition in Invite and Quota Limits",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zipline-before-4.7.0-race-condition-in-invite-and-quota-limits"
}
],
"title": "Zipline before 4.7.0 Race Condition in Invite and Quota Limits",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-126936",
"datePublished": "2026-11-13T09:34:41.165Z",
"dateReserved": "2026-11-11T22:56:41.843Z",
"dateUpdated": "2026-11-13T09:34:41.165Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71462 (GCVE-0-2025-71462)
Vulnerability from nvd – Published: 2026-11-13 09:37 – Updated: 2026-11-13 09:37
VLAI
EPSS
VEX
Title
Zipline before 3.7.12 XSS via url parameter on login page
Summary
Zipline before 3.7.12 contains a cross-site scripting vulnerability in the login page that allows attackers to execute JavaScript by supplying an unvalidated url parameter. Attackers can craft a login link with a javascript: URI in the url parameter that executes in the victim's browser after login.
Severity
6.1 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/diced/zipline/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/zipline-befo… | third-party-advisory |
Impacted products
Date Public
2025-01-31 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "zipline",
"vendor": "diced",
"versions": [
{
"lessThan": "3.7.12",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.7.12",
"versionType": "semver"
}
]
}
],
"datePublic": "2025-01-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zipline before 3.7.12 contains a cross-site scripting vulnerability in the login page that allows attackers to execute JavaScript by supplying an unvalidated url parameter. Attackers can craft a login link with a javascript: URI in the url parameter that executes in the victim\u0027s browser after login."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:37:00.586Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-m288-p6wr-m6gv)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/diced/zipline/security/advisories/GHSA-m288-p6wr-m6gv"
},
{
"name": "VulnCheck Advisory: Zipline before 3.7.12 XSS via url parameter on login page",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zipline-before-3.7.12-xss-via-url-parameter-on-login-page"
}
],
"title": "Zipline before 3.7.12 XSS via url parameter on login page",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2025-71462",
"datePublished": "2026-11-13T09:37:00.586Z",
"dateReserved": "2026-11-11T22:59:26.621Z",
"dateUpdated": "2026-11-13T09:37:00.586Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71461 (GCVE-0-2025-71461)
Vulnerability from nvd – Published: 2026-11-13 09:37 – Updated: 2026-11-13 09:37
VLAI
EPSS
VEX
Title
Zipline before 4.0.2 Predictable Filenames via Math.random State Recovery
Summary
Zipline before 4.0.2 contains a predictable filename vulnerability that allows attackers to infer other users' upload filenames by recovering the Math.random generator state. Attackers with five consecutive gfycat-style filenames can reconstruct the random state to predict previous and future filenames until the instance restarts, exposing private uploads.
Severity
5.3 (Medium)
CWE
- CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/diced/zipline/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/zipline-befo… | third-party-advisory |
Date Public
2025-03-19 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "zipline",
"vendor": "diced"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "allc"
}
],
"datePublic": "2025-03-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zipline before 4.0.2 contains a predictable filename vulnerability that allows attackers to infer other users\u0027 upload filenames by recovering the Math.random generator state. Attackers with five consecutive gfycat-style filenames can reconstruct the random state to predict previous and future filenames until the instance restarts, exposing private uploads."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-338",
"description": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:37:01.263Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-6rg9-q9ww-w2rw)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/diced/zipline/security/advisories/GHSA-6rg9-q9ww-w2rw"
},
{
"name": "VulnCheck Advisory: Zipline before 4.0.2 Predictable Filenames via Math.random State Recovery",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zipline-before-4.0.2-predictable-filenames-via-math-random-state-recovery"
}
],
"title": "Zipline before 4.0.2 Predictable Filenames via Math.random State Recovery",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2025-71461",
"datePublished": "2026-11-13T09:37:01.263Z",
"dateReserved": "2026-11-11T22:59:05.981Z",
"dateUpdated": "2026-11-13T09:37:01.263Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71460 (GCVE-0-2025-71460)
Vulnerability from nvd – Published: 2026-11-13 09:37 – Updated: 2026-11-13 09:37
VLAI
EPSS
VEX
Title
Zipline before 4.2.1 Missing Ownership Check via /api/user/files/transaction
Summary
Zipline before 4.2.1 contains a missing authorization vulnerability in the /api/user/files/transaction endpoint that allows authenticated users to modify other users' files due to absent ownership checks. Attackers who know a target file ID can submit transaction requests to edit or delete files belonging to any user.
Severity
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/diced/zipline/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/zipline-befo… | third-party-advisory |
Impacted products
Date Public
2025-08-08 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "zipline",
"vendor": "diced",
"versions": [
{
"lessThan": "4.2.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.2.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "smashedr"
}
],
"datePublic": "2025-08-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zipline before 4.2.1 contains a missing authorization vulnerability in the /api/user/files/transaction endpoint that allows authenticated users to modify other users\u0027 files due to absent ownership checks. Attackers who know a target file ID can submit transaction requests to edit or delete files belonging to any user."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:37:01.929Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-26wv-mhc3-5xfq)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/diced/zipline/security/advisories/GHSA-26wv-mhc3-5xfq"
},
{
"name": "VulnCheck Advisory: Zipline before 4.2.1 Missing Ownership Check via /api/user/files/transaction",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zipline-before-4.2.1-missing-ownership-check-via-api-user-files-transaction"
}
],
"title": "Zipline before 4.2.1 Missing Ownership Check via /api/user/files/transaction",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2025-71460",
"datePublished": "2026-11-13T09:37:01.929Z",
"dateReserved": "2026-11-11T22:59:01.582Z",
"dateUpdated": "2026-11-13T09:37:01.929Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71459 (GCVE-0-2025-71459)
Vulnerability from nvd – Published: 2026-11-13 09:37 – Updated: 2026-11-13 09:37
VLAI
EPSS
VEX
Title
Zipline through 4.3.2 Path Traversal via x-zipline-filename Header
Summary
Zipline through 4.3.2 contains a path traversal vulnerability that allows authenticated uploaders to write files outside the upload directory by supplying traversal sequences in the x-zipline-filename header. Attackers using the local datasource can create or overwrite files writable by the Zipline process, corrupting application data or disrupting service.
Severity
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/diced/zipline/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/zipline-thro… | third-party-advisory |
Date Public
2025-12-15 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/zipline",
"product": "zipline",
"vendor": "diced",
"versions": [
{
"lessThanOrEqual": "4.3.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "DenizParlak"
}
],
"datePublic": "2025-12-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zipline through 4.3.2 contains a path traversal vulnerability that allows authenticated uploaders to write files outside the upload directory by supplying traversal sequences in the x-zipline-filename header. Attackers using the local datasource can create or overwrite files writable by the Zipline process, corrupting application data or disrupting service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:37:02.598Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-4jm6-mgwv-fq63)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/diced/zipline/security/advisories/GHSA-4jm6-mgwv-fq63"
},
{
"name": "VulnCheck Advisory: Zipline through 4.3.2 Path Traversal via x-zipline-filename Header",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zipline-through-4.3.2-path-traversal-via-x-zipline-filename-header"
}
],
"title": "Zipline through 4.3.2 Path Traversal via x-zipline-filename Header",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2025-71459",
"datePublished": "2026-11-13T09:37:02.598Z",
"dateReserved": "2026-11-11T22:58:40.540Z",
"dateUpdated": "2026-11-13T09:37:02.598Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-58405 (GCVE-0-2024-58405)
Vulnerability from nvd – Published: 2026-11-13 09:37 – Updated: 2026-11-13 09:37
VLAI
EPSS
VEX
Title
Zipline through 3.7.9 Invite Bypass via /api/auth/register Endpoint
Summary
Zipline through 3.7.9 contains an improper authorization vulnerability in the /api/auth/register endpoint, which enforces invite codes only when user registration is disabled, so registration succeeds without an invite when both invites and user registration are enabled. Unauthenticated attackers can send a direct POST request omitting the invite code to create accounts, view stats, and exhaust storage by uploading many files.
Severity
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/diced/zipline/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/zipline-thro… | third-party-advisory |
Date Public
2024-03-05 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "zipline",
"vendor": "diced",
"versions": [
{
"lessThanOrEqual": "3.7.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "resetd3v"
}
],
"datePublic": "2024-03-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zipline through 3.7.9 contains an improper authorization vulnerability in the /api/auth/register endpoint, which enforces invite codes only when user registration is disabled, so registration succeeds without an invite when both invites and user registration are enabled. Unauthenticated attackers can send a direct POST request omitting the invite code to create accounts, view stats, and exhaust storage by uploading many files."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:37:03.249Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-j2cw-9fvc-wr4r)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/diced/zipline/security/advisories/GHSA-j2cw-9fvc-wr4r"
},
{
"name": "VulnCheck Advisory: Zipline through 3.7.9 Invite Bypass via /api/auth/register Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zipline-through-3.7.9-invite-bypass-via-api-auth-register-endpoint"
}
],
"title": "Zipline through 3.7.9 Invite Bypass via /api/auth/register Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2024-58405",
"datePublished": "2026-11-13T09:37:03.249Z",
"dateReserved": "2026-11-11T22:59:38.607Z",
"dateUpdated": "2026-11-13T09:37:03.249Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-58404 (GCVE-0-2024-58404)
Vulnerability from nvd – Published: 2026-11-13 09:37 – Updated: 2026-11-13 09:37
VLAI
EPSS
VEX
Title
Zipline 3.4.5 before 3.7.10 Path Traversal via user export endpoint
Summary
Zipline versions from 3.4.5 before 3.7.10 contain a path traversal vulnerability in the user data export endpoint via the name query parameter. Authenticated attackers can bypass the user id check and use directory traversal sequences to read arbitrary files on the server host.
Severity
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/diced/zipline/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/zipline-3.4.… | third-party-advisory |
Impacted products
Date Public
2024-09-12 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "zipline",
"vendor": "diced",
"versions": [
{
"lessThan": "3.7.10",
"status": "affected",
"version": "3.4.5",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.7.10",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "zipline",
"vendor": "diced",
"versions": [
{
"lessThan": "3.7.10",
"status": "affected",
"version": "3.4.5",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.7.10",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "piprett"
}
],
"datePublic": "2024-09-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zipline versions from 3.4.5 before 3.7.10 contain a path traversal vulnerability in the user data export endpoint via the name query parameter. Authenticated attackers can bypass the user id check and use directory traversal sequences to read arbitrary files on the server host."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:37:03.888Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-v38v-92cm-6mx8)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/diced/zipline/security/advisories/GHSA-v38v-92cm-6mx8"
},
{
"name": "VulnCheck Advisory: Zipline 3.4.5 before 3.7.10 Path Traversal via user export endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zipline-3.4.5-before-3.7.10-path-traversal-via-user-export-endpoint"
}
],
"title": "Zipline 3.4.5 before 3.7.10 Path Traversal via user export endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2024-58404",
"datePublished": "2026-11-13T09:37:03.888Z",
"dateReserved": "2026-11-11T22:59:33.492Z",
"dateUpdated": "2026-11-13T09:37:03.888Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-58404 (GCVE-0-2024-58404)
Vulnerability from cvelistv5 – Published: 2026-11-13 09:37 – Updated: 2026-11-13 09:37
VLAI
EPSS
VEX
Title
Zipline 3.4.5 before 3.7.10 Path Traversal via user export endpoint
Summary
Zipline versions from 3.4.5 before 3.7.10 contain a path traversal vulnerability in the user data export endpoint via the name query parameter. Authenticated attackers can bypass the user id check and use directory traversal sequences to read arbitrary files on the server host.
Severity
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/diced/zipline/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/zipline-3.4.… | third-party-advisory |
Impacted products
Date Public
2024-09-12 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "zipline",
"vendor": "diced",
"versions": [
{
"lessThan": "3.7.10",
"status": "affected",
"version": "3.4.5",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.7.10",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "zipline",
"vendor": "diced",
"versions": [
{
"lessThan": "3.7.10",
"status": "affected",
"version": "3.4.5",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.7.10",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "piprett"
}
],
"datePublic": "2024-09-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zipline versions from 3.4.5 before 3.7.10 contain a path traversal vulnerability in the user data export endpoint via the name query parameter. Authenticated attackers can bypass the user id check and use directory traversal sequences to read arbitrary files on the server host."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:37:03.888Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-v38v-92cm-6mx8)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/diced/zipline/security/advisories/GHSA-v38v-92cm-6mx8"
},
{
"name": "VulnCheck Advisory: Zipline 3.4.5 before 3.7.10 Path Traversal via user export endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zipline-3.4.5-before-3.7.10-path-traversal-via-user-export-endpoint"
}
],
"title": "Zipline 3.4.5 before 3.7.10 Path Traversal via user export endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2024-58404",
"datePublished": "2026-11-13T09:37:03.888Z",
"dateReserved": "2026-11-11T22:59:33.492Z",
"dateUpdated": "2026-11-13T09:37:03.888Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-58405 (GCVE-0-2024-58405)
Vulnerability from cvelistv5 – Published: 2026-11-13 09:37 – Updated: 2026-11-13 09:37
VLAI
EPSS
VEX
Title
Zipline through 3.7.9 Invite Bypass via /api/auth/register Endpoint
Summary
Zipline through 3.7.9 contains an improper authorization vulnerability in the /api/auth/register endpoint, which enforces invite codes only when user registration is disabled, so registration succeeds without an invite when both invites and user registration are enabled. Unauthenticated attackers can send a direct POST request omitting the invite code to create accounts, view stats, and exhaust storage by uploading many files.
Severity
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/diced/zipline/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/zipline-thro… | third-party-advisory |
Date Public
2024-03-05 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "zipline",
"vendor": "diced",
"versions": [
{
"lessThanOrEqual": "3.7.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "resetd3v"
}
],
"datePublic": "2024-03-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zipline through 3.7.9 contains an improper authorization vulnerability in the /api/auth/register endpoint, which enforces invite codes only when user registration is disabled, so registration succeeds without an invite when both invites and user registration are enabled. Unauthenticated attackers can send a direct POST request omitting the invite code to create accounts, view stats, and exhaust storage by uploading many files."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:37:03.249Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-j2cw-9fvc-wr4r)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/diced/zipline/security/advisories/GHSA-j2cw-9fvc-wr4r"
},
{
"name": "VulnCheck Advisory: Zipline through 3.7.9 Invite Bypass via /api/auth/register Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zipline-through-3.7.9-invite-bypass-via-api-auth-register-endpoint"
}
],
"title": "Zipline through 3.7.9 Invite Bypass via /api/auth/register Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2024-58405",
"datePublished": "2026-11-13T09:37:03.249Z",
"dateReserved": "2026-11-11T22:59:38.607Z",
"dateUpdated": "2026-11-13T09:37:03.249Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71459 (GCVE-0-2025-71459)
Vulnerability from cvelistv5 – Published: 2026-11-13 09:37 – Updated: 2026-11-13 09:37
VLAI
EPSS
VEX
Title
Zipline through 4.3.2 Path Traversal via x-zipline-filename Header
Summary
Zipline through 4.3.2 contains a path traversal vulnerability that allows authenticated uploaders to write files outside the upload directory by supplying traversal sequences in the x-zipline-filename header. Attackers using the local datasource can create or overwrite files writable by the Zipline process, corrupting application data or disrupting service.
Severity
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/diced/zipline/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/zipline-thro… | third-party-advisory |
Date Public
2025-12-15 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/zipline",
"product": "zipline",
"vendor": "diced",
"versions": [
{
"lessThanOrEqual": "4.3.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "DenizParlak"
}
],
"datePublic": "2025-12-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zipline through 4.3.2 contains a path traversal vulnerability that allows authenticated uploaders to write files outside the upload directory by supplying traversal sequences in the x-zipline-filename header. Attackers using the local datasource can create or overwrite files writable by the Zipline process, corrupting application data or disrupting service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:37:02.598Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-4jm6-mgwv-fq63)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/diced/zipline/security/advisories/GHSA-4jm6-mgwv-fq63"
},
{
"name": "VulnCheck Advisory: Zipline through 4.3.2 Path Traversal via x-zipline-filename Header",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zipline-through-4.3.2-path-traversal-via-x-zipline-filename-header"
}
],
"title": "Zipline through 4.3.2 Path Traversal via x-zipline-filename Header",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2025-71459",
"datePublished": "2026-11-13T09:37:02.598Z",
"dateReserved": "2026-11-11T22:58:40.540Z",
"dateUpdated": "2026-11-13T09:37:02.598Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71460 (GCVE-0-2025-71460)
Vulnerability from cvelistv5 – Published: 2026-11-13 09:37 – Updated: 2026-11-13 09:37
VLAI
EPSS
VEX
Title
Zipline before 4.2.1 Missing Ownership Check via /api/user/files/transaction
Summary
Zipline before 4.2.1 contains a missing authorization vulnerability in the /api/user/files/transaction endpoint that allows authenticated users to modify other users' files due to absent ownership checks. Attackers who know a target file ID can submit transaction requests to edit or delete files belonging to any user.
Severity
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/diced/zipline/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/zipline-befo… | third-party-advisory |
Impacted products
Date Public
2025-08-08 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "zipline",
"vendor": "diced",
"versions": [
{
"lessThan": "4.2.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.2.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "smashedr"
}
],
"datePublic": "2025-08-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zipline before 4.2.1 contains a missing authorization vulnerability in the /api/user/files/transaction endpoint that allows authenticated users to modify other users\u0027 files due to absent ownership checks. Attackers who know a target file ID can submit transaction requests to edit or delete files belonging to any user."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:37:01.929Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-26wv-mhc3-5xfq)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/diced/zipline/security/advisories/GHSA-26wv-mhc3-5xfq"
},
{
"name": "VulnCheck Advisory: Zipline before 4.2.1 Missing Ownership Check via /api/user/files/transaction",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zipline-before-4.2.1-missing-ownership-check-via-api-user-files-transaction"
}
],
"title": "Zipline before 4.2.1 Missing Ownership Check via /api/user/files/transaction",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2025-71460",
"datePublished": "2026-11-13T09:37:01.929Z",
"dateReserved": "2026-11-11T22:59:01.582Z",
"dateUpdated": "2026-11-13T09:37:01.929Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71461 (GCVE-0-2025-71461)
Vulnerability from cvelistv5 – Published: 2026-11-13 09:37 – Updated: 2026-11-13 09:37
VLAI
EPSS
VEX
Title
Zipline before 4.0.2 Predictable Filenames via Math.random State Recovery
Summary
Zipline before 4.0.2 contains a predictable filename vulnerability that allows attackers to infer other users' upload filenames by recovering the Math.random generator state. Attackers with five consecutive gfycat-style filenames can reconstruct the random state to predict previous and future filenames until the instance restarts, exposing private uploads.
Severity
5.3 (Medium)
CWE
- CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/diced/zipline/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/zipline-befo… | third-party-advisory |
Date Public
2025-03-19 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "zipline",
"vendor": "diced"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "allc"
}
],
"datePublic": "2025-03-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zipline before 4.0.2 contains a predictable filename vulnerability that allows attackers to infer other users\u0027 upload filenames by recovering the Math.random generator state. Attackers with five consecutive gfycat-style filenames can reconstruct the random state to predict previous and future filenames until the instance restarts, exposing private uploads."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-338",
"description": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:37:01.263Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-6rg9-q9ww-w2rw)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/diced/zipline/security/advisories/GHSA-6rg9-q9ww-w2rw"
},
{
"name": "VulnCheck Advisory: Zipline before 4.0.2 Predictable Filenames via Math.random State Recovery",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zipline-before-4.0.2-predictable-filenames-via-math-random-state-recovery"
}
],
"title": "Zipline before 4.0.2 Predictable Filenames via Math.random State Recovery",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2025-71461",
"datePublished": "2026-11-13T09:37:01.263Z",
"dateReserved": "2026-11-11T22:59:05.981Z",
"dateUpdated": "2026-11-13T09:37:01.263Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71462 (GCVE-0-2025-71462)
Vulnerability from cvelistv5 – Published: 2026-11-13 09:37 – Updated: 2026-11-13 09:37
VLAI
EPSS
VEX
Title
Zipline before 3.7.12 XSS via url parameter on login page
Summary
Zipline before 3.7.12 contains a cross-site scripting vulnerability in the login page that allows attackers to execute JavaScript by supplying an unvalidated url parameter. Attackers can craft a login link with a javascript: URI in the url parameter that executes in the victim's browser after login.
Severity
6.1 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/diced/zipline/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/zipline-befo… | third-party-advisory |
Impacted products
Date Public
2025-01-31 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "zipline",
"vendor": "diced",
"versions": [
{
"lessThan": "3.7.12",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.7.12",
"versionType": "semver"
}
]
}
],
"datePublic": "2025-01-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zipline before 3.7.12 contains a cross-site scripting vulnerability in the login page that allows attackers to execute JavaScript by supplying an unvalidated url parameter. Attackers can craft a login link with a javascript: URI in the url parameter that executes in the victim\u0027s browser after login."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:37:00.586Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-m288-p6wr-m6gv)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/diced/zipline/security/advisories/GHSA-m288-p6wr-m6gv"
},
{
"name": "VulnCheck Advisory: Zipline before 3.7.12 XSS via url parameter on login page",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zipline-before-3.7.12-xss-via-url-parameter-on-login-page"
}
],
"title": "Zipline before 3.7.12 XSS via url parameter on login page",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2025-71462",
"datePublished": "2026-11-13T09:37:00.586Z",
"dateReserved": "2026-11-11T22:59:26.621Z",
"dateUpdated": "2026-11-13T09:37:00.586Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126936 (GCVE-0-2026-126936)
Vulnerability from cvelistv5 – Published: 2026-11-13 09:34 – Updated: 2026-11-13 09:34
VLAI
EPSS
VEX
Title
Zipline before 4.7.0 Race Condition in Invite and Quota Limits
Summary
Zipline before 4.7.0 contains a race condition vulnerability that allows users to bypass invitation usage limits, upload storage quotas, and shortened-URL quotas through concurrent requests. Attackers can send overlapping registration, upload, or URL creation requests that pass checks against stale state, creating extra accounts and exceeding administrator-configured resource quotas.
Severity
CWE
- CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/diced/zipline/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/zipline-befo… | third-party-advisory |
Impacted products
Date Public
2026-08-16 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "zipline",
"vendor": "diced",
"versions": [
{
"lessThan": "4.7.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.7.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "tonghuaroot"
}
],
"datePublic": "2026-08-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zipline before 4.7.0 contains a race condition vulnerability that allows users to bypass invitation usage limits, upload storage quotas, and shortened-URL quotas through concurrent requests. Attackers can send overlapping registration, upload, or URL creation requests that pass checks against stale state, creating extra accounts and exceeding administrator-configured resource quotas."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "Time-of-check Time-of-use (TOCTOU) Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:34:41.165Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-wq7g-g9f8-8q2p)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/diced/zipline/security/advisories/GHSA-wq7g-g9f8-8q2p"
},
{
"name": "VulnCheck Advisory: Zipline before 4.7.0 Race Condition in Invite and Quota Limits",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zipline-before-4.7.0-race-condition-in-invite-and-quota-limits"
}
],
"title": "Zipline before 4.7.0 Race Condition in Invite and Quota Limits",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-126936",
"datePublished": "2026-11-13T09:34:41.165Z",
"dateReserved": "2026-11-11T22:56:41.843Z",
"dateUpdated": "2026-11-13T09:34:41.165Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}