Threats tagged 'ghsa-gxr6-mx45-w66j'

Zipline versions before 4.6.4 have an information disclosure vulnerability in the GET /api/server/folder/:id endpoint. This flaw allows unauthenticated attackers who know a folder's UUID to list files in non-public upload-only folders. By manipulating the page query parameter, attackers can bypass metadata-only restrictions and enumerate file details such as names, IDs, MIME types, sizes, and view counts.