ZIPLINE · CVE-2025-71460 · Package
NO FIX YET · SEE WHAT TO DO
Zipline, a self-hosted file sharing server, has a missing ownership check on its /api/user/files/transaction endpoint. An authenticated user who knows another user's file ID can edit or delete that file.
first public Aug 8, 2025 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running a self-hosted Zipline instance with more than one user account are exposed, since any account can act on files owned by others if it knows the file ID. Single-user instances, or instances where all accounts are fully trusted, are less exposed. Managed hosting is the vendor's responsibility.
Not affected if managed-hosting, single-user
Who cares file-sharing, self-hosted, zipline
zipline --version or the version field in its package.json, and compare it with the fixed release below.4.2.1 or later.Zipline before 4.2.1 contains a missing authorization vulnerability in the /api/user/files/transaction endpoint that allows authenticated users to modify other users' files due to absent ownership checks. Attackers who know a target file ID can submit transaction requests to edit or delete files belonging to any user.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.