CVE-2025-71462 · Package
NO FIX YET · SEE WHAT TO DO
Zipline, a self-hosted file sharing server, fails to validate the url parameter on its login page. An attacker can craft a login link with a javascript: URI that runs script in the victim's browser after they log in.
first public Jan 31, 2025 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that run Zipline 3.7.x or earlier and expose its login page to users. The flaw needs a crafted link that a user must open and then log in through, so exposure depends on whether users follow links to your instance.
Not affected if zipline-3.7.12-or-later
Who cares self-hosted, zipline
package.json or the container image tag.url parameter handling in your deployed build if you have modified it.3.7.12 (fixes all versions before 3.7.12).Zipline before 3.7.12 contains a cross-site scripting vulnerability in the login page that allows attackers to execute JavaScript by supplying an unvalidated url parameter. Attackers can craft a login link with a javascript: URI in the url parameter that executes in the victim's browser after login.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.