CVE-2026-126938 · Package
NO FIX YET · SEE WHAT TO DO
Zipline, a self-hosted file sharing server, lets a logged-in user forge Content-Range offsets on chunked uploads. An attacker can send tiny chunks with large declared offsets to make the server create oversized files and fill its disk.
first public Jul 6, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted Zipline instances before 4.6.4 where users can log in and upload files through chunked uploads. Instances that restrict uploads to trusted accounts have a smaller exposure but are still affected by the flaw itself. Teams using a managed Zipline service can leave it to the provider.
Not affected if managed-hosting, version-4.6.4-or-later
Who cares file-uploads, self-hosted, zipline
4.6.4 are affected.4.6.4 or later.Zipline before 4.6.4 contains a resource allocation vulnerability that allows authenticated users to bypass chunked-upload size and quota checks by forging Content-Range offsets and totals. Attackers can send tiny chunks to the partial upload endpoint with large declared offsets, causing the server to create oversized files and exhaust disk space.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.