ZIPLINE · CVE-2026-126942 · Package
NO FIX YET · SEE WHAT TO DO
Zipline, a self-hosted file sharing server, lets any logged-in user reparent other users' files by supplying their file IDs when creating a folder. An attacker can learn victims' file URLs and remove those files from the victims' folder views.
first public Jun 3, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that run a self-hosted Zipline instance with more than one user account before version 4.6.2. The attacker must have an account on that instance, and file IDs must be obtainable, for example from public folders. Single-user instances or instances on managed hosting are unlikely to be exposed.
Not affected if managed-hosting, single-user-instance
Who cares file-sharing, self-hosted, zipline
4.6.2.4.6.2 or later (per the NVD description).Zipline before 4.6.2 contains a missing authorization vulnerability in POST /api/user/folders that allows authenticated users to reparent other users' files by supplying their file IDs. Attackers can harvest file IDs from public folders and create a folder seeded with them, disclosing victims' file URLs and removing those files from their folder views.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.