ZIPLINE · CVE-2025-71459 · Other
FIX → 4.4.0 ✓ verified
Zipline through 4.3.2 lets an authenticated uploader use traversal sequences in the x-zipline-filename header to write files outside the upload directory. An attacker with an upload account can create or overwrite files the Zipline process can write, corrupting data or disrupting the service.
first public Dec 15, 2025 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted Zipline instances up to 4.3.2 that use the local datasource and give accounts upload access are exposed: an authenticated uploader can set a traversal path in the x-zipline-filename header and create or overwrite files outside the upload directory that the Zipline process can write. It does not give root, and code execution is only a possible follow-on if a file that later gets loaded is overwritten. Instances with no untrusted uploaders, or without the local datasource, can skip it.
Not affected if no-untrusted-uploaders, non-local-datasource, upload-disabled, v4.4.0-or-later
Who cares npm, self-hosted, zipline
Zipline through 4.3.2 contains a path traversal vulnerability that allows authenticated uploaders to write files outside the upload directory by supplying traversal sequences in the x-zipline-filename header. Attackers using the local datasource can create or overwrite files writable by the Zipline process, corrupting application data or disrupting service.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Upgrade to 4.4.0
Upgrade Zipline to v4.4.0 or later (sanitizes upload filenames and adds containment checks in local storage operations).