CVE-2025-71461 · Package
NO FIX YET · SEE WHAT TO DO
Zipline before 4.0.2 generates upload filenames with Math.random, which can be reconstructed from five observed gfycat-style names. An attacker can then predict other users' upload filenames and reach private uploads until the instance restarts.
first public Mar 19, 2025 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that self-host Zipline as a file-sharing service where several users upload files that should stay private. An attacker who can see a few public upload URLs could guess others. Instances used by one person, or where uploads are not private, have less exposure.
Not affected if public-uploads-only, single-user-instance
Who cares self-hosted, zipline
4.0.24.0.2 or laterZipline before 4.0.2 contains a predictable filename vulnerability that allows attackers to infer other users' upload filenames by recovering the Math.random generator state. Attackers with five consecutive gfycat-style filenames can reconstruct the random state to predict previous and future filenames until the instance restarts, exposing private uploads.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.