Threats tagged 'ghsa-6h3m-pw73-74r6'

Zipline versions through 4.4.0 have a path traversal vulnerability in the PATCH /api/user/files/:id rename endpoint. Authenticated users can exploit this flaw by supplying crafted file names that bypass database uniqueness checks but are normalized by the system, allowing overwriting of existing uploaded files.