---
id: "CVE-2025-71459"
page: "https://infrastack.ai/live/CVE-2025-71459"
kind: "vulnerability"
aliases: ["CVE-2025-71459"]
title: "Zipline: authenticated uploaders can write files outside the upload directory"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "zipline", "fixed": ["4.4.0"], "affected": "<= 4.3.2", "ecosystem": "npm"}]
ecosystems: []
tags: ["npm", "other", "self-hosted", "zipline"]
not_affected_if: ["no-untrusted-uploaders", "non-local-datasource", "upload-disabled", "v4.4.0-or-later"]
published_at: "2026-11-13T10:17:23+00:00"
first_seen_at: "2026-11-13T10:47:09+00:00"
updated_at: "2026-11-13T10:54:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71459", "first_seen_at": "2026-11-13T10:47:09+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-13T10:54:18+00:00"}]
exploit_sources: []
---

# Zipline: authenticated uploaders can write files outside the upload directory

Link for people: https://infrastack.ai/live/CVE-2025-71459 (this .md is for agents)

Zipline through 4.3.2 lets an authenticated uploader use traversal sequences in the x-zipline-filename header to write files outside the upload directory. An attacker with an upload account can create or overwrite files the Zipline process can write, corrupting data or disrupting the service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:zipline affected <= 4.3.2 fixed 4.4.0

## How to check

- Check the Zipline version; versions <= 4.3.2 are affected, v4.4.0 or later contains the fix.
- Check that your datasource is set to local; the advisory requires the local datasource.
- Check who has upload access (any authenticated uploader can exploit it) and which files the Zipline process can write.

## Fix

Upgrade Zipline to v4.4.0 or later (sanitizes upload filenames and adds containment checks in local storage operations).

## Timeline

- 2026-11-13T10:47:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-71459
- 2026-11-13T10:54:18+00:00 analyst — Read GHSA-4jm6-mgwv-fq63: affected <=4.3.2 (first affected v4 not established); fix text says containment fix first present in v4.4.0, though the patched-versions field says None; needs upload access + local datasource. No PoC link or exploitation reported.

## Documents

- [advisory] Vendor advisory: github.com https://github.com/diced/zipline/security/advisories/GHSA-4jm6-mgwv-fq63
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/zipline-through-4.3.2-path-traversal-via-x-zipline-filename-header

## From the sources

Zipline through 4.3.2 contains a path traversal vulnerability that allows authenticated uploaders to write files outside the upload directory by supplying traversal sequences in the x-zipline-filename header. Attackers using the local datasource can create or overwrite files writable by the Zipline process, corrupting application data or disrupting service.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_