CVE-2026-126940 · Package
NO FIX YET · SEE WHAT TO DO
Zipline before 4.6.4 lets remote attackers evade login rate limits by varying query strings or sending an x-zipline-p-filename header. That allows unlimited password guessing against login and file or short-link password endpoints.
first public Jul 6, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that self-host Zipline, the file and short-link sharing server, on an internet-reachable address and run versions before 4.6.4. The bypass targets rate limiting on login and password-protected file or short-link pages, so instances without password-protected content or with other access controls in front are lower risk.
Not affected if managed-hosting, version-4.6.4-or-later
Who cares self-hosted, zipline
4.6.4.4.6.4 or later.Zipline before 4.6.4 contains a rate limit bypass vulnerability that allows remote attackers to evade request limits by varying query strings or supplying the x-zipline-p-filename header. Attackers can append differing query parameters to login and file or short-link password verification endpoints to perform credential guessing beyond the intended rate limits.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.