Threats tagged 'ghsa-fgmp-c7w8-4q2x'

Zipline versions before 4.6.2 have a missing authorization vulnerability in the POST /api/user/folders endpoint. Authenticated users can exploit this flaw to reparent files belonging to other users by supplying their file IDs. Attackers can gather these file IDs from public folders, create a folder containing them, and thereby disclose the victims' file URLs while removing those files from the victims' folder views.