{"id":"CVE-2024-58404","kind":"vulnerability","aliases":["CVE-2024-58404"],"related":[],"title":"Zipline: path traversal in data export lets users read server files","description":"Zipline versions from 3.4.5 before 3.7.10 contain a path traversal vulnerability in the user data export endpoint via the name query parameter. Authenticated attackers can bypass the user id check and use directory traversal sequences to read arbitrary files on the server host.","summary":"Zipline, a self-hosted file sharing server, has a path traversal flaw in its user data export endpoint, controlled by the name query parameter. An logged-in attacker can use directory traversal sequences to read arbitrary files from the server host.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"zipline","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["other","self-hosted","zipline"],"not_affected_if":["no-user-accounts","version-3.7.10-or-later"],"how_to_check":"- Check the installed Zipline version; affected versions are from `3.4.5` before `3.7.10`.\n- Confirm whether the user data export endpoint is reachable from outside your network.","fix":"- Zipline: move to `3.7.10` or later.","status":"open","published_at":"2026-11-13T10:17:23+00:00","first_seen_at":"2026-11-13T10:47:09+00:00","triaged_at":"2026-11-13T10:51:20+00:00","updated_at":"2026-11-13T10:51:20+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-13T10:51:20Z","model":"claude-haiku-5-5","output":{"fix":"- Zipline: move to `3.7.10` or later.","reach":"internet","title":"Zipline: path traversal in data export lets users read server files","impact":"high","summary":"Zipline, a self-hosted file sharing server, has a path traversal flaw in its user data export endpoint, controlled by the name query parameter. An logged-in attacker can use directory traversal sequences to read arbitrary files from the server host.","audience":"businesses","category":"other","nicknames":[],"who_cares":["zipline","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated attacker reads arbitrary files on the server host","analyst_note":"","how_to_check":"- Check the installed Zipline version; affected versions are from `3.4.5` before `3.7.10`.\n- Confirm whether the user data export endpoint is reachable from outside your network.","plain_action":"","product_name":"zipline","needs_analyst":false,"not_affected_if":["version-3.7.10-or-later","no-user-accounts"],"who_is_affected":"Teams that self-host Zipline from version 3.4.5 up to but not including 3.7.10 are exposed. The attacker needs a valid user account on the instance, so instances with open registration or shared logins carry more risk than those restricted to trusted users.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000712,"input_tokens":4588,"output_tokens":506,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2024':13A,16A '-58404':14A,17A '3.4.5':70C '3.7.10':72C 'arbitrari':61B,104C 'attack':53B,90C 'authent':89C 'bypass':92C 'check':96C 'contain':73C 'control':43B 'cve':12A,15A 'data':5A,40B,81C 'directori':56B,99C 'endpoint':42B,83C 'export':6A,41B,82C 'file':11A,29B,62B,105C 'flaw':36B 'host':22B,28B,66B,109C 'id':95C 'let':7A 'log':51B 'logged-in':50B 'name':46B,86C 'paramet':48B,88C 'path':2A,34B,75C 'queri':47B,87C 'read':9A,60B,103C 'self':21B,27B 'self-host':20B,26B 'sequenc':58B,101C 'server':10A,31B,65B,108C 'share':30B 'travers':3A,35B,57B,76C,100C 'use':55B,98C 'user':8A,39B,80C,94C 'version':68C 'via':84C 'vulner':77C 'ziplin':1A,23B,24B,67C 'zipline':18A","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Zipline from version 3.4.5 up to but not including 3.7.10 are exposed. The attacker needs a valid user account on the instance, so instances with open registration or shared logins carry more risk than those restricted to trusted users.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["zipline"],"ptokens":["zipline"],"labels":["high","other","selfhosted","vendor","zipline"],"campaign_type":null,"search_a":"'-2024':13A,16A '-58404':14A,17A 'cve':12A,15A 'data':5A 'export':6A 'file':11A 'let':7A 'path':2A 'read':9A 'server':10A 'travers':3A 'user':8A 'ziplin':1A 'zipline':18A","search_b":"'arbitrari':61B 'attack':53B 'control':43B 'data':40B 'directori':56B 'endpoint':42B 'export':41B 'file':29B,62B 'flaw':36B 'host':22B,28B,66B 'log':51B 'logged-in':50B 'name':46B 'paramet':48B 'path':34B 'queri':47B 'read':60B 'self':21B,27B 'self-host':20B,26B 'sequenc':58B 'server':31B,65B 'share':30B 'travers':35B,57B 'use':55B 'user':39B 'ziplin':23B,24B","search_c":"'3.4.5':70C '3.7.10':72C 'arbitrari':104C 'attack':90C 'authent':89C 'bypass':92C 'check':96C 'contain':73C 'data':81C 'directori':99C 'endpoint':83C 'export':82C 'file':105C 'host':109C 'id':95C 'name':86C 'paramet':88C 'path':75C 'queri':87C 'read':103C 'sequenc':101C 'server':108C 'travers':76C,100C 'use':98C 'user':80C,94C 'version':68C 'via':84C 'vulner':77C 'ziplin':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2024-09-12T18:53:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2024-58404","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58404","severity":null,"published_at":"2026-11-13T10:17:23+00:00","modified_at":"2026-11-13T10:17:23+00:00","first_seen_at":"2026-11-13T10:47:09+00:00","fetched_at":"2026-11-13T10:47:09+00:00","note":null}],"documents":[{"id":144842,"url":"https://github.com/diced/zipline/security/advisories/GHSA-v38v-92cm-6mx8","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2024-09-12T18:53:19+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144843,"url":"https://www.vulncheck.com/advisories/zipline-3.4.5-before-3.7.10-path-traversal-via-user-export-endpoint","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}