CVE-2026-126939

Versions of Zipline prior to 4.6.4 are vulnerable to an information disclosure flaw in the GET /api/server/folder/:id endpoint. An unauthenticated attacker who possesses a folder UUID can supply a page query parameter to bypass the metadata-only early return. This allows for the enumeration of fi...

EUVD-2026-125126

Zipline before 4.6.4 contains an information disclosure vulnerability in GET /api/server/folder/:id that allows unauthenticated attackers to list files in non-public upload-only folders. Attackers who know the folder UUID can supply the page query parameter to bypass the metadata-only early retur...