Threats tagged 'ghsa-jw2p-vjc6-c7jj'

Zipline versions before 4.6.1 have a path traversal vulnerability in the LocalDatasource component. This flaw allows users with SUPERADMIN privileges to read or delete files outside the designated upload directory by importing records with specially crafted traversal filenames. The vulnerability can be exploited by triggering unchecked byte-range requests or by setting expired deletion times, enabling unauthorized file deletion accessible to the Zipline process.