CVE-2026-126951

Zipline through 4.4.0 contains a path traversal vulnerability that allows authenticated users to read arbitrary server files by abusing a fallback treating the :id parameter as a datasource key. Attackers can send encoded traversal sequences in the :id of GET /api/user/files/:id/raw to escape the...

CVE-2026-126949

Zipline through 4.4.0 contains a path traversal vulnerability in the PATCH /api/user/files/:id rename endpoint that allows authenticated users to overwrite existing uploads by supplying unsanitized names. Attackers can submit names like ../uploads/victim.txt that bypass the raw-string database...

CVE-2025-71460

Zipline before 4.2.1 contains a missing authorization vulnerability in the /api/user/files/transaction endpoint that allows authenticated users to modify other users' files due to absent ownership checks. Attackers who know a target file ID can submit transaction requests to edit or delete files...

EUVD-2025-211321

Zipline before 4.2.1 contains a missing authorization vulnerability in the /api/user/files/transaction endpoint that allows authenticated users to modify other users' files due to absent ownership checks. Attackers who know a target file ID can submit transaction requests to edit or delete files...

CVE-2025-71460 Zipline before 4.2.1 Missing Ownership Check via /api/user/files/transaction

Zipline before 4.2.1 contains a missing authorization vulnerability in the /api/user/files/transaction endpoint that allows authenticated users to modify other users' files due to absent ownership checks. Attackers who know a target file ID can submit transaction requests to edit or delete files...

CVE-2025-71460

Zipline versions before 4.2.1 are vulnerable to a missing authorization flaw in the /api/user/files/transaction endpoint. The root cause is the absence of ownership checks , which allows authenticated users to modify or delete files belonging to other users if they possess a target file ID. No sp...

CVE-2026-126949 Zipline through 4.4.0 Path Traversal File Overwrite via PATCH /api/user/files/:id

Zipline through 4.4.0 contains a path traversal vulnerability in the PATCH /api/user/files/:id rename endpoint that allows authenticated users to overwrite existing uploads by supplying unsanitized names. Attackers can submit names like ../uploads/victim.txt that bypass the raw-string database...

EUVD-2026-125116

Zipline through 4.4.0 contains a path traversal vulnerability in the PATCH /api/user/files/:id rename endpoint that allows authenticated users to overwrite existing uploads by supplying unsanitized names. Attackers can submit names like ../uploads/victim.txt that bypass the raw-string database...

CVE-2026-126949

Zipline through version 4.4.0 is vulnerable to a path traversal vulnerability in the PATCH /api/user/files/:id rename endpoint. This flaw allows authenticated users with high privileges to overwrite existing uploads by providing unsanitized names . Because the system performs a database uniquenes...

CVE-2026-126951 Zipline through 4.4.0 Authenticated Path Traversal via /api/user/files/:id/raw

Zipline through 4.4.0 contains a path traversal vulnerability that allows authenticated users to read arbitrary server files by abusing a fallback treating the :id parameter as a datasource key. Attackers can send encoded traversal sequences in the :id of GET /api/user/files/:id/raw to escape the...

EUVD-2026-125114

Zipline through 4.4.0 contains a path traversal vulnerability that allows authenticated users to read arbitrary server files by abusing a fallback treating the :id parameter as a datasource key. Attackers can send encoded traversal sequences in the :id of GET /api/user/files/:id/raw to escape the...

CVE-2026-126951

Zipline through version 4.4.0 is affected by an authenticated path traversal vulnerability in the /api/user/files/:id/raw endpoint. The root cause is a fallback mechanism that incorrectly treats the :id parameter as a datasource key . By sending encoded traversal sequences in the :id parameter, a...

CVE-2026-126951 Zipline through 4.4.0 Authenticated Path Traversal via /api/user/files/:id/raw

Zipline through 4.4.0 contains a path traversal vulnerability that allows authenticated users to read arbitrary server files by abusing a fallback treating the :id parameter as a datasource key. Attackers can send encoded traversal sequences in the :id of GET /api/user/files/:id/raw to escape the...

EUVD-2026-124142

Zipline 4.6.2 before 4.8.0 contains a policy bypass vulnerability that allows authenticated users to evade administrator-disabled MIME types by editing file metadata. Attackers can upload a permitted file, then set a disabled type such as text/html through PATCH /api/user/files/:id so /raw/:id...

CVE-2026-126932

Zipline 4.6.2 before 4.8.0 contains a policy bypass vulnerability that allows authenticated users to evade administrator-disabled MIME types by editing file metadata. Attackers can upload a permitted file, then set a disabled type such as text/html through PATCH /api/user/files/:id so /raw/:id...

CVE-2026-126932

Zipline 4.6.2 before 4.8.0 contains a policy bypass vulnerability that allows authenticated users to evade administrator-disabled MIME types by editing file metadata. Attackers can upload a permitted file, then set a disabled type such as text/html through PATCH /api/user/files/:id so /raw/:id...

CVE-2026-126932

Zipline versions 4.6.2 before 4.8.0 are vulnerable to a policy bypass vulnerability. This flaw allows authenticated users to evade administrator-imposed restrictions on MIME types by manipulating file metadata. An attacker can upload a permitted file and subsequently use the PATCH /api/user/files...

CVE-2026-126932 Zipline 4.6.2 before 4.8.0 Disabled MIME Type Policy Bypass via File Metadata Update

Zipline 4.6.2 before 4.8.0 contains a policy bypass vulnerability that allows authenticated users to evade administrator-disabled MIME types by editing file metadata. Attackers can upload a permitted file, then set a disabled type such as text/html through PATCH /api/user/files/:id so /raw/:id...

CVE-2026-126932 Zipline 4.6.2 before 4.8.0 Disabled MIME Type Policy Bypass via File Metadata Update

Zipline 4.6.2 before 4.8.0 contains a policy bypass vulnerability that allows authenticated users to evade administrator-disabled MIME types by editing file metadata. Attackers can upload a permitted file, then set a disabled type such as text/html through PATCH /api/user/files/:id so /raw/:id...

PT-2026-145628

Name of the Vulnerable Software and Affected Versions Zipline versions 4.6.2 through 4.7.x Description Authenticated users can bypass administrator-defined MIME type restrictions by modifying file metadata. An attacker can upload a file that is permitted by the system and subsequently change its...