CVE-2026-126932

Zipline 4.6.2 before 4.8.0 contains a policy bypass vulnerability that allows authenticated users to evade administrator-disabled MIME types by editing file metadata. Attackers can upload a permitted file, then set a disabled type such as text/html through PATCH /api/user/files/:id so /raw/:id serves that Content-Type.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/diced/zipline/blob/v4.7.0/src/server/routes/api/user/files/%5Bid%5D/index.ts#L96
https://github.com/diced/zipline/commit/fc8e886ca841b86a3f677cd7dac1bf9a5bd45b2c
https://github.com/diced/zipline/releases/tag/v4.8.0
https://github.com/diced/zipline/security/advisories/GHSA-rgxm-54cf-whf7
https://www.vulncheck.com/advisories/zipline-4.6.2-before-4.8.0-disabled-mime-type-policy-bypass-via-file-metadata-update