CVE-2026-126944 · Package
NO FIX YET · SEE WHAT TO DO
Zipline before 4.6.1 has a path traversal flaw in its LocalDatasource that lets a SUPERADMIN user import records with traversal filenames. An attacker can read or delete files the Zipline process can access outside the upload directory.
first public May 20, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that self-host Zipline with local file storage and have SUPERADMIN accounts; the flaw needs an administrator-level account to import crafted records. Instances on managed hosting or with only trusted superadmins carry less risk, but upgrading to 4.6.1 closes it.
Not affected if already-on-4.6.1, no-superadmin-users
Who cares file-sharing, self-hosted, zipline
4.6.1.4.6.1 or later.Zipline before 4.6.1 contains a path traversal vulnerability in LocalDatasource that allows SUPERADMIN users to read or delete files outside the upload directory by importing records with traversal filenames. Attackers can trigger the unchecked range-read path with byte-range requests or set expired deletion times to delete files accessible to the Zipline process.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.