CVE-2026-126950

Zipline through 4.4.0 contains a path traversal vulnerability that allows authenticated attackers to delete arbitrary server files by injecting traversal sequences via the x-zipline-file-extension header. Attackers can upload a file with a poisoned stored name and short expiry so LocalDatasource...

CVE-2026-126944

Zipline versions before 4.6.1 are vulnerable to a path traversal vulnerability within the LocalDatasource component. This flaw allows users with SUPERADMIN privileges to read or delete files outside the intended upload directory by importing records containing traversal filenames. Specifically, a...

EUVD-2026-125121

Zipline before 4.6.1 contains a path traversal vulnerability in LocalDatasource that allows SUPERADMIN users to read or delete files outside the upload directory by importing records with traversal filenames. Attackers can trigger the unchecked range-read path with byte-range requests or set...