Threats tagged 'ghsa-mgrr-rv7j-f4x4'

Zipline versions 4.0.0 up to but not including 4.8.0 contain an upload filter bypass vulnerability. This flaw allows users with upload permissions to bypass administrator restrictions on blocked file types due to a mismatch in how file extensions are checked. The vulnerability arises because the upload handlers compare dotted, case-sensitive extensions against undotted disabledExtensions entries, enabling bypass of file type restrictions.