CVE-2026-126933

Zipline 4.0.0 before 4.8.0 contains an upload filter bypass vulnerability that allows users with upload access to store blocked file types due to extension format mismatch. The upload and partial handlers compare dotted, case-sensitive extensions against undotted disabledExtensions entries, letting authenticated or permitted unauthenticated folder uploaders bypass administrator restrictions.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/diced/zipline/blob/v4.7.0/src/server/routes/api/upload/index.ts#L170
https://github.com/diced/zipline/blob/v4.7.0/src/server/routes/api/upload/partial.ts#L294
https://github.com/diced/zipline/commit/dbc1fe502130a8ebd95fa04886efec01402e5b5f
https://github.com/diced/zipline/releases/tag/v4.8.0
https://github.com/diced/zipline/security/advisories/GHSA-wwrw-gq56-7wpj
https://www.vulncheck.com/advisories/zipline-4.0.0-before-4.8.0-disabled-extensions-upload-filter-bypass-via-extension-format-mismatch