---
id: "CVE-2024-58404"
page: "https://infrastack.ai/live/CVE-2024-58404"
kind: "vulnerability"
aliases: ["CVE-2024-58404"]
title: "Zipline: path traversal in data export lets users read server files"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "zipline", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["other", "self-hosted", "zipline"]
not_affected_if: ["no-user-accounts", "version-3.7.10-or-later"]
published_at: "2026-11-13T10:17:23+00:00"
first_seen_at: "2026-11-13T10:47:09+00:00"
updated_at: "2026-11-13T10:51:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-58404", "first_seen_at": "2026-11-13T10:47:09+00:00"}]
exploit_sources: []
---

# Zipline: path traversal in data export lets users read server files

Link for people: https://infrastack.ai/live/CVE-2024-58404 (this .md is for agents)

Zipline, a self-hosted file sharing server, has a path traversal flaw in its user data export endpoint, controlled by the name query parameter. An logged-in attacker can use directory traversal sequences to read arbitrary files from the server host.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:zipline affected range not listed fixed no fixed version listed

## How to check

- Check the installed Zipline version; affected versions are from `3.4.5` before `3.7.10`.
- Confirm whether the user data export endpoint is reachable from outside your network.

## Fix

- Zipline: move to `3.7.10` or later.

## Timeline

- 2026-11-13T10:47:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-58404

## Documents

- [advisory] Vendor advisory: github.com https://github.com/diced/zipline/security/advisories/GHSA-v38v-92cm-6mx8
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/zipline-3.4.5-before-3.7.10-path-traversal-via-user-export-endpoint

## From the sources

Zipline versions from 3.4.5 before 3.7.10 contain a path traversal vulnerability in the user data export endpoint via the name query parameter. Authenticated attackers can bypass the user id check and use directory traversal sequences to read arbitrary files on the server host.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_