{"id":"CVE-2026-126933","kind":"vulnerability","aliases":["CVE-2026-126933"],"related":[],"title":"Zipline: upload filter bypass lets users store blocked file types","description":"Zipline 4.0.0 before 4.8.0 contains an upload filter bypass vulnerability that allows users with upload access to store blocked file types due to extension format mismatch. The upload and partial handlers compare dotted, case-sensitive extensions against undotted disabledExtensions entries, letting authenticated or permitted unauthenticated folder uploaders bypass administrator restrictions.","summary":"Zipline, a self-hosted file sharing server, compares file extensions with dots and letter case in a way that does not match its disabled-extensions list. Users with upload access can therefore store file types the administrator meant to block.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["file-uploads","package","self-hosted","zipline"],"not_affected_if":["no-disabled-extensions-configured","version-4.8.0-or-later"],"how_to_check":"- Check the Zipline version in your deployment; versions `4.0.0` up to but not including `4.8.0` are affected.\n- Review the `disabledExtensions` setting and confirm whether uploads of those types succeed.","fix":"- Upgrade Zipline to `4.8.0` or later.","status":"open","published_at":"2026-11-11T23:17:23+00:00","first_seen_at":"2026-11-11T23:29:41+00:00","triaged_at":"2026-11-11T23:31:19+00:00","updated_at":"2026-11-11T23:31:19+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T23:31:19Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Zipline to `4.8.0` or later.","reach":"network","title":"Zipline: upload filter bypass lets users store blocked file types","impact":"low","summary":"Zipline, a self-hosted file sharing server, compares file extensions with dots and letter case in a way that does not match its disabled-extensions list. Users with upload access can therefore store file types the administrator meant to block.","audience":"businesses","category":"package","nicknames":[],"who_cares":["zipline","self-hosted","file-uploads"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"blocked file types get stored on the server, bypassing admin policy","analyst_note":"Some sources say authenticated users only, others mention unauthenticated folder uploaders; confirm from the vendor advisory.,","how_to_check":"- Check the Zipline version in your deployment; versions `4.0.0` up to but not including `4.8.0` are affected.\n- Review the `disabledExtensions` setting and confirm whether uploads of those types succeed.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-4.8.0-or-later","no-disabled-extensions-configured"],"who_is_affected":"Zipline 4.0.0 through 4.7.x instances that restrict uploads with the disabled extensions setting. Users with upload access, including unauthenticated folder uploaders where permitted, can bypass those restrictions. Instances that do not use disabled extensions, or that are on 4.8.0 or later, are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000752,"input_tokens":4656,"output_tokens":573,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126933':13A,16A '-2026':12A,15A '4.0.0':68C '4.8.0':70C 'access':56B,82C 'administr':63B,116C 'allow':78C 'authent':109C 'block':8A,66B,85C 'bypass':4A,75C,115C 'case':40B,101C 'case-sensit':100C 'compar':33B,98C 'contain':71C 'cve':11A,14A 'disabl':50B 'disabled-extens':49B 'disabledextens':106C 'dot':37B,99C 'due':88C 'entri':107C 'extens':35B,51B,90C,103C 'file':9A,18B,30B,34B,60B,86C 'file-upload':17B 'filter':3A,74C 'folder':113C 'format':91C 'handler':97C 'host':23B,29B 'let':5A,108C 'letter':39B 'list':52B 'match':47B 'meant':64B 'mismatch':92C 'packag':20B 'partial':96C 'permit':111C 'restrict':117C 'self':22B,28B 'self-host':21B,27B 'sensit':102C 'server':32B 'share':31B 'store':7A,59B,84C 'therefor':58B 'type':10A,61B,87C 'unauthent':112C 'undot':105C 'upload':2A,19B,55B,73C,81C,94C,114C 'user':6A,53B,79C 'vulner':76C 'way':43B 'ziplin':1A,24B,25B,67C","nicknames":[],"mitigations":[],"who_affected":"Zipline 4.0.0 through 4.7.x instances that restrict uploads with the disabled extensions setting. Users with upload access, including unauthenticated folder uploaders where permitted, can bypass those restrictions. Instances that do not use disabled extensions, or that are on 4.8.0 or later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fileuploads","medium","package","selfhosted","zipline"],"campaign_type":null,"search_a":"'-126933':13A,16A '-2026':12A,15A 'block':8A 'bypass':4A 'cve':11A,14A 'file':9A 'filter':3A 'let':5A 'store':7A 'type':10A 'upload':2A 'user':6A 'ziplin':1A","search_b":"'access':56B 'administr':63B 'block':66B 'case':40B 'compar':33B 'disabl':50B 'disabled-extens':49B 'dot':37B 'extens':35B,51B 'file':18B,30B,34B,60B 'file-upload':17B 'host':23B,29B 'letter':39B 'list':52B 'match':47B 'meant':64B 'packag':20B 'self':22B,28B 'self-host':21B,27B 'server':32B 'share':31B 'store':59B 'therefor':58B 'type':61B 'upload':19B,55B 'user':53B 'way':43B 'ziplin':24B,25B","search_c":"'4.0.0':68C '4.8.0':70C 'access':82C 'administr':116C 'allow':78C 'authent':109C 'block':85C 'bypass':75C,115C 'case':101C 'case-sensit':100C 'compar':98C 'contain':71C 'disabledextens':106C 'dot':99C 'due':88C 'entri':107C 'extens':90C,103C 'file':86C 'filter':74C 'folder':113C 'format':91C 'handler':97C 'let':108C 'mismatch':92C 'partial':96C 'permit':111C 'restrict':117C 'sensit':102C 'store':84C 'type':87C 'unauthent':112C 'undot':105C 'upload':73C,81C,94C,114C 'user':79C 'vulner':76C 'ziplin':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-27T23:13:31+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126933","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126933","severity":null,"published_at":"2026-11-11T23:17:23+00:00","modified_at":"2026-11-11T23:17:23+00:00","first_seen_at":"2026-11-11T23:29:41+00:00","fetched_at":"2026-11-11T23:29:41+00:00","note":null}],"documents":[{"id":129949,"url":"https://github.com/diced/zipline/commit/dbc1fe502130a8ebd95fa04886efec01402e5b5f","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":129946,"url":"https://github.com/diced/zipline/releases/tag/v4.8.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":129951,"url":"https://github.com/diced/zipline/security/advisories/GHSA-wwrw-gq56-7wpj","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-27T23:13:31+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":129952,"url":"https://www.vulncheck.com/advisories/zipline-4.0.0-before-4.8.0-disabled-extensions-upload-filter-bypass-via-extension-format-mismatch","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}