Threats tagged 'ghsa-mhgx-q5qw-7237'

Zipline versions through 4.4.0 have a path traversal vulnerability that allows authenticated attackers to delete arbitrary server files. This is achieved by injecting traversal sequences via the x-zipline-file-extension header. The attack involves uploading a file with a specially crafted stored name and short expiry, causing the LocalDatasource deletion process to remove chosen files, potentially leading to denial of service or data loss.