{"id":"CVE-2026-126935","kind":"vulnerability","aliases":["CVE-2026-126935"],"related":[],"title":"Zipline: race condition lets file view limits be exceeded","description":"Zipline before 4.8.0 contains a race condition vulnerability in src/server/routes/raw/[id].ts that allows remote attackers to bypass file maxViews limits through non-atomic view counting. Attackers holding a file link can send parallel requests that read the same pre-increment count, viewing view-limited or delete-on-max-views files beyond their limit.","summary":"Zipline before 4.8.0 counts file views non-atomically, so parallel requests read the same count before it increases. A person holding a file link can view a limited or delete-on-max-views file more times than allowed.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","zipline"],"not_affected_if":["no-view-limits","version-4.8.0-or-later"],"how_to_check":"- Check the running Zipline version; `4.8.0` or later is not affected by this flaw.\n- Look at src/server/routes/raw/[id].ts in your deployed copy for how view counting is done.","fix":"- Zipline: upgrade to `4.8.0` or later.","status":"open","published_at":"2026-11-11T23:17:23+00:00","first_seen_at":"2026-11-11T23:29:41+00:00","triaged_at":"2026-11-11T23:31:19+00:00","updated_at":"2026-11-11T23:31:19+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T23:31:19Z","model":"claude-haiku-5-5","output":{"fix":"- Zipline: upgrade to `4.8.0` or later.","reach":"internet","title":"Zipline: race condition lets file view limits be exceeded","impact":"low","summary":"Zipline before 4.8.0 counts file views non-atomically, so parallel requests read the same count before it increases. A person holding a file link can view a limited or delete-on-max-views file more times than allowed.","audience":"businesses","category":"package","nicknames":[],"who_cares":["zipline","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"file view limits are bypassed, exposing files past their allowed views","analyst_note":"","how_to_check":"- Check the running Zipline version; `4.8.0` or later is not affected by this flaw.\n- Look at src/server/routes/raw/[id].ts in your deployed copy for how view counting is done.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-4.8.0-or-later","no-view-limits"],"who_is_affected":"Teams that self-host Zipline with files that use maxViews limits or delete-on-max-views. An attacker needs a file link and can send parallel requests to the raw file route. Installs on 4.8.0 or later, or with no view limits set, are not exposed to this flaw.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000717,"input_tokens":4646,"output_tokens":504,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126935':12A,15A '-2026':11A,14A '4.8.0':23B,63C 'allow':60B,74C 'atom':29B,85C 'attack':76C,88C 'beyond':116C 'bypass':78C 'condit':3A,67C 'contain':64C 'count':24B,36B,87C,104C 'cve':10A,13A 'delet':52B,111C 'delete-on-max-view':51B,110C 'exceed':9A 'file':5A,25B,44B,56B,79C,91C,115C 'hold':42B,89C 'host':19B 'id':71C 'increas':39B 'increment':103C 'let':4A 'limit':7A,49B,81C,108C,118C 'link':45B,92C 'max':54B,113C 'maxview':80C 'non':28B,84C 'non-atom':27B,83C 'packag':16B 'parallel':31B,95C 'person':41B 'pre':102C 'pre-incr':101C 'race':2A,66C 'read':33B,98C 'remot':75C 'request':32B,96C 'self':18B 'self-host':17B 'send':94C 'src/server/routes/raw':70C 'time':58B 'ts':72C 'view':6A,26B,47B,55B,86C,105C,107C,114C 'view-limit':106C 'vulner':68C 'ziplin':1A,20B,21B,61C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Zipline with files that use maxViews limits or delete-on-max-views. An attacker needs a file link and can send parallel requests to the raw file route. Installs on 4.8.0 or later, or with no view limits set, are not exposed to this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","zipline"],"campaign_type":null,"search_a":"'-126935':12A,15A '-2026':11A,14A 'condit':3A 'cve':10A,13A 'exceed':9A 'file':5A 'let':4A 'limit':7A 'race':2A 'view':6A 'ziplin':1A","search_b":"'4.8.0':23B 'allow':60B 'atom':29B 'count':24B,36B 'delet':52B 'delete-on-max-view':51B 'file':25B,44B,56B 'hold':42B 'host':19B 'increas':39B 'limit':49B 'link':45B 'max':54B 'non':28B 'non-atom':27B 'packag':16B 'parallel':31B 'person':41B 'read':33B 'request':32B 'self':18B 'self-host':17B 'time':58B 'view':26B,47B,55B 'ziplin':20B,21B","search_c":"'4.8.0':63C 'allow':74C 'atom':85C 'attack':76C,88C 'beyond':116C 'bypass':78C 'condit':67C 'contain':64C 'count':87C,104C 'delet':111C 'delete-on-max-view':110C 'file':79C,91C,115C 'hold':89C 'id':71C 'increment':103C 'limit':81C,108C,118C 'link':92C 'max':113C 'maxview':80C 'non':84C 'non-atom':83C 'parallel':95C 'pre':102C 'pre-incr':101C 'race':66C 'read':98C 'remot':75C 'request':96C 'send':94C 'src/server/routes/raw':70C 'ts':72C 'view':86C,105C,107C,114C 'view-limit':106C 'vulner':68C 'ziplin':61C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-27T23:13:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126935","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126935","severity":null,"published_at":"2026-11-11T23:17:23+00:00","modified_at":"2026-11-11T23:17:23+00:00","first_seen_at":"2026-11-11T23:29:41+00:00","fetched_at":"2026-11-11T23:29:41+00:00","note":null}],"documents":[{"id":129957,"url":"https://github.com/diced/zipline/commit/1770479d6795ea8700f0ce6ba08a1654d3644c73","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":129946,"url":"https://github.com/diced/zipline/releases/tag/v4.8.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":129959,"url":"https://github.com/diced/zipline/security/advisories/GHSA-7xv9-wr46-j578","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-27T23:13:19+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":129960,"url":"https://www.vulncheck.com/advisories/zipline-before-4.8.0-maxviews-limit-bypass-via-race-condition","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}