CVE-2026-126933
mediumZipline 4.0.0 before 4.8.0 contains an upload filter bypass vulnerability that allows users with upload access to store blocked file types due to extension for…
Zipline 4.0.0 before 4.8.0 contains an upload filter bypass vulnerability that allows users with upload access to store blocked file types due to extension format mismatch. The upload and partial handlers compare dotted, case-sensitive extensions against undotted disabledExtensions entries, letting authenticated or permitted unauthenticated folder uploaders bypass administrator restrictions.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/diced/zipline/blob/v4.7.0/src/server/routes/api/upload/index.ts#L170 disclosure@vulncheck.com
- https://github.com/diced/zipline/blob/v4.7.0/src/server/routes/api/upload/partial.ts#L294 disclosure@vulncheck.com
- https://github.com/diced/zipline/commit/dbc1fe502130a8ebd95fa04886efec01402e5b5f disclosure@vulncheck.com
- https://github.com/diced/zipline/releases/tag/v4.8.0 disclosure@vulncheck.com
- https://github.com/diced/zipline/security/advisories/GHSA-wwrw-gq56-7wpj disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/zipline-4.0.0-before-4.8.0-disabled-extensions-upload... disclosure@vulncheck.com