Zipline versions from 3.4.5 before 3.7.10 contain a path traversal vulnerability in the user data export endpoint via the name query parameter. Authenticated attackers can bypass the user id check and use directory traversal sequences to read arbitrary files on the server host.
Zipline through 3.7.9 contains an improper authorization vulnerability in the /api/auth/register endpoint, which enforces invite codes only when user registration is disabled, so registration succeeds without an invite when both invites and user registration are enabled. Unauthenticated attackers can send a direct POST request omitting the invite code to create accounts, view stats, and exhaust storage by uploading many files.
Zipline through 4.3.2 contains a path traversal vulnerability that allows authenticated uploaders to write files outside the upload directory by supplying traversal sequences in the x-zipline-filename header. Attackers using the local datasource can create or overwrite files writable by the Zipline process, corrupting application data or disrupting service.
Zipline before 4.2.1 contains a missing authorization vulnerability in the /api/user/files/transaction endpoint that allows authenticated users to modify other users' files due to absent ownership checks. Attackers who know a target file ID can submit transaction requests to edit or delete files belonging to any user.
Zipline before 4.0.2 contains a predictable filename vulnerability that allows attackers to infer other users' upload filenames by recovering the Math.random generator state. Attackers with five consecutive gfycat-style filenames can reconstruct the random state to predict previous and future filenames until the instance restarts, exposing private uploads.
Zipline before 3.7.12 contains a cross-site scripting vulnerability in the login page that allows attackers to execute JavaScript by supplying an unvalidated url parameter. Attackers can craft a login link with a javascript: URI in the url parameter that executes in the victim's browser after login.
Zipline versions before 4.7.0 have a time-of-check to time-of-use (TOCTOU) race condition vulnerability. This flaw allows attackers to bypass limits on invitation usage, upload storage, and shortened-URL creation by sending concurrent overlapping requests. Exploitation can result in creation of extra accounts and exceeding administrator-configured resource quotas.
Zipline versions before 4.6.5 have a time-of-check to time-of-use (TOCTOU) race condition in the POST /api/setup endpoint. This flaw allows unauthenticated attackers to create multiple SUPERADMIN accounts by sending concurrent requests before the firstSetup flag is reset. Attackers exploit this by racing requests with spoofed X-Forwarded-For headers during the argon2 password hashing process, gaining full administrative control.
Zipline versions before 4.6.4 have a resource allocation vulnerability that allows authenticated users to bypass chunked-upload size and quota restrictions by forging Content-Range headers. This enables attackers to cause the server to allocate excessive disk space by sending small chunks with large declared offsets, potentially exhausting disk resources.
Zipline versions prior to 4.6.4 contain an information disclosure vulnerability in the GET /api/server/folder/:id endpoint. This flaw allows unauthenticated attackers who know a folder's UUID to enumerate file details such as names, IDs, MIME types, sizes, and view counts in non-public upload-only folders by manipulating the page query parameter. The vulnerability is fixed in version 4.6.4.
Zipline versions before 4.6.4 have a vulnerability allowing remote attackers to bypass rate limiting on authentication attempts. By varying query strings or using the x-zipline-p-filename header, attackers can circumvent request limits on login and password verification endpoints, enabling credential guessing attacks beyond intended protections.
Zipline versions up to 4.6.2 have an authorization bypass vulnerability allowing authenticated administrators to access superadmin secrets. The API endpoints GET /api/users and GET /api/users/:id do not enforce the canInteract check, exposing plaintext totpSecret and OAuth tokens. This flaw enables attackers to bypass two-factor authentication and take over superadmin accounts. Additionally, any authenticated user can enumerate other users' folders via GET /api/user/folders.
CVE-2026-126942 is an authorization bypass vulnerability in diced zipline versions before 4.6.2. It affects the POST /api/user/folders endpoint, allowing authenticated users to reparent files belonging to other users by supplying their file IDs. Attackers can gather file IDs from public folders and create folders seeded with those IDs, which discloses victims' file URLs and removes those files from their original folder views.
Zipline versions from 4.2.0 up to but not including 4.6.2 contain a vulnerability where sensitive environment variables, including OAuth2 client secrets, are logged in plaintext at startup. This exposure allows attackers with access to system or Docker logs to retrieve these secrets and potentially exchange intercepted OAuth2 callbacks for valid tokens. The issue is fixed in version 4.6.2.
Zipline versions before 4.6.1 have a path traversal vulnerability in the LocalDatasource component. This flaw allows SUPERADMIN users to read or delete files outside the designated upload directory by importing records with specially crafted traversal filenames. Attackers can also exploit unchecked byte-range requests or manipulate deletion times to delete files accessible to the Zipline process. The vulnerability is fixed in version 4.6.1.
Zipline versions before 4.5.1 have a stored cross-site scripting (XSS) vulnerability in the HighlightCode component. This flaw allows authenticated attackers to upload text files with malicious HTML/JavaScript that execute in other users' browsers, potentially enabling unauthorized API calls such as account modifications. The vulnerability is fixed in version 4.5.1.
Zipline versions from 4.3.0 up to but not including 4.5.0 contain a stored cross-site scripting (XSS) vulnerability. Authenticated low-privilege users can inject malicious HTML and JavaScript via unescaped embed settings in server-side rendered meta tags. This allows execution of arbitrary scripts in the browsers of visitors viewing affected file pages. The vulnerability is fixed in version 4.5.0.
Zipline versions before 4.5.0 have a stored open redirect vulnerability in the POST /api/user/urls endpoint. Authenticated users can create short URLs that redirect to arbitrary destinations, including javascript: URIs or attacker-controlled URLs. This can lead visitors of trusted short links to phishing or malware sites. The vulnerability is fixed in version 4.5.0.
Zipline versions before 4.5.0 have an authorization bypass vulnerability due to missing ownership verification in PATCH and DELETE API handlers for user folders. Authenticated attackers can manipulate folder IDs belonging to other users to rename, make public, enable uploads, or delete those folders without proper authorization.
Zipline versions up to 4.4.0 have a path traversal vulnerability in the PATCH /api/user/files/:id rename endpoint. Authenticated users can exploit this flaw by submitting crafted filenames with directory traversal sequences (e.g., ../uploads/victim.txt) that bypass database uniqueness checks but are normalized by the system, allowing overwriting of arbitrary uploaded files.