{"id":"CVE-2026-126939","kind":"vulnerability","aliases":["CVE-2026-126939"],"related":[],"title":"Zipline: unauthenticated folder listing exposes file names and metadata","description":"Zipline before 4.6.4 contains an information disclosure vulnerability in GET /api/server/folder/:id that allows unauthenticated attackers to list files in non-public upload-only folders. Attackers who know the folder UUID can supply the page query parameter to bypass the metadata-only early return and enumerate file names, IDs, MIME types, sizes, and view counts.","summary":"Zipline before 4.6.4 lets anyone who knows a non-public upload-only folder's UUID list the files in it through GET /api/server/folder/:id by adding a page parameter. The attacker gets file names, IDs, MIME types, sizes and view counts.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","self-hosted","zipline"],"not_affected_if":["no-upload-only-folders","zipline-4.6.4-or-later"],"how_to_check":"- Check the installed Zipline version and see whether it is below `4.6.4`.\n- Look for `/api/server/folder/` routes reachable without a session on your public hostname.","fix":"- Zipline: move to `4.6.4` or later, per the advisory the sources link.","status":"open","published_at":"2026-11-13T10:18:00+00:00","first_seen_at":"2026-11-13T10:47:27+00:00","triaged_at":"2026-11-13T10:54:43+00:00","updated_at":"2026-11-13T10:54:43+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-13T10:54:43Z","model":"claude-haiku-5-5","output":{"fix":"- Zipline: move to `4.6.4` or later, per the advisory the sources link.","reach":"internet","title":"Zipline: unauthenticated folder listing exposes file names and metadata","impact":"low","summary":"Zipline before 4.6.4 lets anyone who knows a non-public upload-only folder's UUID list the files in it through GET /api/server/folder/:id by adding a page parameter. The attacker gets file names, IDs, MIME types, sizes and view counts.","audience":"businesses","category":"other","nicknames":[],"who_cares":["zipline","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Unauthenticated attacker lists file names and metadata in private folders","analyst_note":"Confirm the fixed version and whether a vendor advisory lists a safe upgrade path, via the linked github.com advisory.","how_to_check":"- Check the installed Zipline version and see whether it is below `4.6.4`.\n- Look for `/api/server/folder/` routes reachable without a session on your public hostname.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["zipline-4.6.4-or-later","no-upload-only-folders"],"who_is_affected":"Teams that self-host Zipline, the file-upload and sharing server, and expose upload-only folders to the internet. Instances on 4.6.4 or later are not affected, and instances that run no upload-only folders have nothing to leak.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000736,"input_tokens":4620,"output_tokens":548,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126939':12A,15A '-2026':11A,14A '/api/server/folder':45B,74C '4.6.4':23B,66C 'add':48B 'allow':77C 'anyon':25B 'attack':53B,79C,91C 'bypass':104C 'contain':67C 'count':63B,121C 'cve':10A,13A 'disclosur':70C 'earli':109C 'enumer':112C 'expos':5A 'file':6A,40B,55B,82C,113C 'folder':3A,35B,90C,95C 'get':44B,54B,73C 'host':19B 'id':46B,57B,75C,115C 'inform':69C 'know':27B,93C 'let':24B 'list':4A,38B,81C 'metadata':9A,107C 'metadata-on':106C 'mime':58B,116C 'name':7A,56B,114C 'non':30B,85C 'non-publ':29B,84C 'page':50B,100C 'paramet':51B,102C 'public':31B,86C 'queri':101C 'return':110C 'self':18B 'self-host':17B 'size':60B,118C 'suppli':98C 'type':59B,117C 'unauthent':2A,78C 'upload':33B,88C 'upload-on':32B,87C 'uuid':37B,96C 'view':62B,120C 'vulner':71C 'ziplin':1A,20B,21B,64C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Zipline, the file-upload and sharing server, and expose upload-only folders to the internet. Instances on 4.6.4 or later are not affected, and instances that run no upload-only folders have nothing to leak.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","other","selfhosted","zipline"],"campaign_type":null,"search_a":"'-126939':12A,15A '-2026':11A,14A 'cve':10A,13A 'expos':5A 'file':6A 'folder':3A 'list':4A 'metadata':9A 'name':7A 'unauthent':2A 'ziplin':1A","search_b":"'/api/server/folder':45B '4.6.4':23B 'add':48B 'anyon':25B 'attack':53B 'count':63B 'file':40B,55B 'folder':35B 'get':44B,54B 'host':19B 'id':46B,57B 'know':27B 'let':24B 'list':38B 'mime':58B 'name':56B 'non':30B 'non-publ':29B 'page':50B 'paramet':51B 'public':31B 'self':18B 'self-host':17B 'size':60B 'type':59B 'upload':33B 'upload-on':32B 'uuid':37B 'view':62B 'ziplin':20B,21B","search_c":"'/api/server/folder':74C '4.6.4':66C 'allow':77C 'attack':79C,91C 'bypass':104C 'contain':67C 'count':121C 'disclosur':70C 'earli':109C 'enumer':112C 'file':82C,113C 'folder':90C,95C 'get':73C 'id':75C,115C 'inform':69C 'know':93C 'list':81C 'metadata':107C 'metadata-on':106C 'mime':116C 'name':114C 'non':85C 'non-publ':84C 'page':100C 'paramet':102C 'public':86C 'queri':101C 'return':110C 'size':118C 'suppli':98C 'type':117C 'unauthent':78C 'upload':88C 'upload-on':87C 'uuid':96C 'view':120C 'vulner':71C 'ziplin':64C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-06T19:32:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126939","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126939","severity":null,"published_at":"2026-11-13T10:18:00+00:00","modified_at":"2026-11-13T10:18:00+00:00","first_seen_at":"2026-11-13T10:47:27+00:00","fetched_at":"2026-11-13T10:47:27+00:00","note":null}],"documents":[{"id":145239,"url":"https://github.com/diced/zipline/security/advisories/GHSA-jh6v-w5f3-8p4x","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-06T19:32:20+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145240,"url":"https://www.vulncheck.com/advisories/zipline-before-4.6.4-unauthenticated-file-listing-via-page-query-parameter","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}