CVE-2026-126933

Description

Zipline 4.0.0 before 4.8.0 contains an upload filter bypass vulnerability that allows users with upload access to store blocked file types due to extension format mismatch. The upload and partial handlers compare dotted, case-sensitive extensions against undotted disabledExtensions entries, letting authenticated or permitted unauthenticated folder uploaders bypass administrator restrictions.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://github.com/diced/zipline/security/advisories/GHSA-wwrw-gq56-7wpj ↗
• https://github.com/diced/zipline/commit/dbc1fe502130a8ebd95fa04886efec01402e5b5f ↗
• https://github.com/diced/zipline/releases/tag/v4.8.0 ↗
• https://github.com/diced/zipline/blob/v4.7.0/src/server/routes/api/upload/index.ts#L170 ↗
• https://github.com/diced/zipline/blob/v4.7.0/src/server/routes/api/upload/partial.ts#L294 ↗
• https://www.vulncheck.com/advisories/zipline-4.0.0-before-4.8.0-disabled-extensions-upload-filter-bypass-via-extension-format-mismatch ↗