Threats tagged 'ghsa-grch-mvpr-p564'

Zipline versions from 4.6.2 up to but not including 4.8.0 contain a policy bypass vulnerability. Authenticated users can evade administrator-disabled MIME types by modifying file metadata via a PATCH request, allowing them to upload files with disallowed content types such as text/html. This could lead to unauthorized content being served with a disabled MIME type.