CVE-2026-126935 · Package
NO FIX YET · SEE WHAT TO DO
Zipline before 4.8.0 counts file views non-atomically, so parallel requests read the same count before it increases. A person holding a file link can view a limited or delete-on-max-views file more times than allowed.
first public Sep 27, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that self-host Zipline with files that use maxViews limits or delete-on-max-views. An attacker needs a file link and can send parallel requests to the raw file route. Installs on 4.8.0 or later, or with no view limits set, are not exposed to this flaw.
Not affected if no-view-limits, version-4.8.0-or-later
Who cares self-hosted, zipline
4.8.0 or later is not affected by this flaw.4.8.0 or later.Zipline before 4.8.0 contains a race condition vulnerability in src/server/routes/raw/[id].ts that allows remote attackers to bypass file maxViews limits through non-atomic view counting. Attackers holding a file link can send parallel requests that read the same pre-increment count, viewing view-limited or delete-on-max-views files beyond their limit.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.