---
id: "CVE-2026-126933"
page: "https://infrastack.ai/live/CVE-2026-126933"
kind: "vulnerability"
aliases: ["CVE-2026-126933"]
title: "Zipline: upload filter bypass lets users store blocked file types"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["file-uploads", "package", "self-hosted", "zipline"]
not_affected_if: ["no-disabled-extensions-configured", "version-4.8.0-or-later"]
published_at: "2026-11-11T23:17:23+00:00"
first_seen_at: "2026-11-11T23:29:41+00:00"
updated_at: "2026-11-11T23:31:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126933", "first_seen_at": "2026-11-11T23:29:41+00:00"}]
exploit_sources: []
---

# Zipline: upload filter bypass lets users store blocked file types

Link for people: https://infrastack.ai/live/CVE-2026-126933 (this .md is for agents)

Zipline, a self-hosted file sharing server, compares file extensions with dots and letter case in a way that does not match its disabled-extensions list. Users with upload access can therefore store file types the administrator meant to block.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Zipline version in your deployment; versions `4.0.0` up to but not including `4.8.0` are affected.
- Review the `disabledExtensions` setting and confirm whether uploads of those types succeed.

## Fix

- Upgrade Zipline to `4.8.0` or later.

## Timeline

- 2026-11-11T23:29:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126933

## Documents

- [advisory] Vendor advisory: github.com https://github.com/diced/zipline/security/advisories/GHSA-wwrw-gq56-7wpj
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/zipline-4.0.0-before-4.8.0-disabled-extensions-upload-filter-bypass-via-extension-format-mismatch
- [fix] Patch: github.com https://github.com/diced/zipline/commit/dbc1fe502130a8ebd95fa04886efec01402e5b5f
- [fix] Release notes: github.com https://github.com/diced/zipline/releases/tag/v4.8.0

## From the sources

Zipline 4.0.0 before 4.8.0 contains an upload filter bypass vulnerability that allows users with upload access to store blocked file types due to extension format mismatch. The upload and partial handlers compare dotted, case-sensitive extensions against undotted disabledExtensions entries, letting authenticated or permitted unauthenticated folder uploaders bypass administrator restrictions.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_