Threats tagged 'ghsa-9hwf-5x47-5rvr'

Zipline versions through 4.4.0 have a path traversal vulnerability that allows authenticated users to read arbitrary files on the server. This occurs by exploiting a fallback mechanism where the :id parameter in the GET /api/user/files/:id/raw endpoint is treated as a datasource key. Attackers can use encoded traversal sequences to escape the intended uploads directory and access sensitive files such as /etc/shadow.