Medium severity4.3NVD Advisory· Published Nov 11, 2026
CVE-2026-126933
CVE-2026-126933
Description
Zipline 4.0.0 before 4.8.0 contains an upload filter bypass vulnerability that allows users with upload access to store blocked file types due to extension format mismatch. The upload and partial handlers compare dotted, case-sensitive extensions against undotted disabledExtensions entries, letting authenticated or permitted unauthenticated folder uploaders bypass administrator restrictions.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
6- github.com/diced/zipline/blob/v4.7.0/src/server/routes/api/upload/index.tsnvd
- github.com/diced/zipline/blob/v4.7.0/src/server/routes/api/upload/partial.tsnvd
- github.com/diced/zipline/commit/dbc1fe502130a8ebd95fa04886efec01402e5b5fnvd
- github.com/diced/zipline/releases/tag/v4.8.0nvd
- github.com/diced/zipline/security/advisories/GHSA-wwrw-gq56-7wpjnvd
- www.vulncheck.com/advisories/zipline-4.0.0-before-4.8.0-disabled-extensions-upload-filter-bypass-via-extension-format-mismatchnvd
News mentions
0No linked articles in our index yet.