ZIPLINE · CVE-2026-126946 · Other
NO FIX YET · SEE WHAT TO DO
Zipline versions 4.3.0 before 4.5.0 let a logged-in low-privilege user save embed title, description, site name or color values that are placed unescaped into page meta tags. When another person opens that user's file view page, the injected HTML runs JavaScript in their browser.
first public Mar 21, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted Zipline instances from 4.3.0 up to but not including 4.5.0 where users can set embed settings. Visitors to file view pages are the victims, so exposure is greatest on instances shared with people outside the admin team. Instances on versions outside that range are not affected by this flaw.
Not affected if default-config
Who cares file-sharing, self-hosted, zipline
4.3.0 or later but before 4.5.0 is affected.PATCH /api/user for unexpected values in embedTitle, embedDescription, embedSiteName or embedColor.4.5.0 or later.Zipline from 4.3.0 before 4.5.0 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject HTML through unescaped embed settings in SSR meta tags. Attackers can set malicious embedTitle, embedDescription, embedSiteName, or embedColor values via PATCH /api/user to execute JavaScript in browsers of visitors opening their file view pages.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.