CVE-2026-126939 · Other
NO FIX YET · SEE WHAT TO DO
Zipline before 4.6.4 lets anyone who knows a non-public upload-only folder's UUID list the files in it through GET /api/server/folder/:id by adding a page parameter. The attacker gets file names, IDs, MIME types, sizes and view counts.
first public Jul 6, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that self-host Zipline, the file-upload and sharing server, and expose upload-only folders to the internet. Instances on 4.6.4 or later are not affected, and instances that run no upload-only folders have nothing to leak.
Not affected if no-upload-only-folders, zipline-4.6.4-or-later
Who cares self-hosted, zipline
4.6.4./api/server/folder/ routes reachable without a session on your public hostname.4.6.4 or later, per the advisory the sources link.Zipline before 4.6.4 contains an information disclosure vulnerability in GET /api/server/folder/:id that allows unauthenticated attackers to list files in non-public upload-only folders. Attackers who know the folder UUID can supply the page query parameter to bypass the metadata-only early return and enumerate file names, IDs, MIME types, sizes, and view counts.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.