Threats affecting pkg:npm/zipline

Zipline through 4.3.2 contains a path traversal vulnerability that allows authenticated uploaders to write files outside the upload directory by supplying traversal sequences in the x-zipline-filename header. Attackers using the local datasource can create or overwrite files writable by the Zipline process, corrupting application data or disrupting service.

Zipline versions prior to 4.6.4 contain an information disclosure vulnerability in the GET /api/server/folder/:id endpoint. This flaw allows unauthenticated attackers who know a folder's UUID to enumerate file details such as names, IDs, MIME types, sizes, and view counts in non-public upload-only folders by manipulating the page query parameter. The vulnerability is fixed in version 4.6.4.

Zipline versions before 4.6.4 have a vulnerability allowing remote attackers to bypass rate limiting on authentication attempts. By varying query strings or using the x-zipline-p-filename header, attackers can circumvent request limits on login and password verification endpoints, enabling credential guessing attacks beyond intended protections.

CVE-2026-126942 is an authorization bypass vulnerability in diced zipline versions before 4.6.2. It affects the POST /api/user/folders endpoint, allowing authenticated users to reparent files belonging to other users by supplying their file IDs. Attackers can gather file IDs from public folders and create folders seeded with those IDs, which discloses victims' file URLs and removes those files from their original folder views.

Zipline versions from 4.2.0 up to but not including 4.6.2 contain a vulnerability where sensitive environment variables, including OAuth2 client secrets, are logged in plaintext at startup. This exposure allows attackers with access to system or Docker logs to retrieve these secrets and potentially exchange intercepted OAuth2 callbacks for valid tokens. The issue is fixed in version 4.6.2.

Zipline versions before 4.6.1 have a path traversal vulnerability in the LocalDatasource component. This flaw allows SUPERADMIN users to read or delete files outside the designated upload directory by importing records with specially crafted traversal filenames. Attackers can also exploit unchecked byte-range requests or manipulate deletion times to delete files accessible to the Zipline process. The vulnerability is fixed in version 4.6.1.

Zipline versions before 4.5.0 have an authorization bypass vulnerability due to missing ownership verification in PATCH and DELETE API handlers for user folders. Authenticated attackers can manipulate folder IDs belonging to other users to rename, make public, enable uploads, or delete those folders without proper authorization.