{"id":"CVE-2026-126947","kind":"vulnerability","aliases":["CVE-2026-126947"],"related":[],"title":"Zipline: stored open redirect lets users set malicious short link destinations","description":"Zipline before 4.5.0 contains a stored open redirect vulnerability that allows authenticated users to set arbitrary short URL destinations by abusing missing scheme validation in POST /api/user/urls. Attackers can store javascript: URIs or attacker-controlled URLs as destinations, causing visitors of the trusted short link to be redirected to phishing or malware pages.","summary":"Zipline before 4.5.0 does not validate the URL scheme when users create short links through POST /api/user/urls. An authenticated user can store javascript: or attacker-controlled destinations, so visitors of a trusted short link are sent to phishing or malware pages.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"zipline","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["other","self-hosted","zipline"],"not_affected_if":["no-untrusted-users","zipline-4.5.0-or-later"],"how_to_check":"- Check the installed Zipline version, for example by reading the `version` field in its `package.json` or the image tag in your deployment.\n- Confirm whether untrusted users can create accounts or short links on your instance.","fix":"- Zipline `4.5.0` or later, per the sources.","status":"open","published_at":"2026-11-13T10:18:01+00:00","first_seen_at":"2026-11-13T10:47:28+00:00","triaged_at":"2026-11-13T10:56:48+00:00","updated_at":"2026-11-13T10:56:48+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-13T10:56:48Z","model":"claude-haiku-5-5","output":{"fix":"- Zipline `4.5.0` or later, per the sources.","reach":"internet","title":"Zipline: stored open redirect lets users set malicious short link destinations","impact":"medium","summary":"Zipline before 4.5.0 does not validate the URL scheme when users create short links through POST /api/user/urls. An authenticated user can store javascript: or attacker-controlled destinations, so visitors of a trusted short link are sent to phishing or malware pages.","audience":"businesses","category":"other","nicknames":[],"who_cares":["zipline","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"visitors redirected to phishing or malware pages via trusted links","analyst_note":"","how_to_check":"- Check the installed Zipline version, for example by reading the `version` field in its `package.json` or the image tag in your deployment.\n- Confirm whether untrusted users can create accounts or short links on your instance.","plain_action":"","product_name":"zipline","needs_analyst":false,"not_affected_if":["zipline-4.5.0-or-later","no-untrusted-users"],"who_is_affected":"Zipline instances before 4.5.0 where users can create short links. Exposure depends on who holds an account, since the flaw requires an authenticated user. Instances where only trusted administrators create links carry much lower risk.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000723,"input_tokens":4622,"output_tokens":521,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126947':14A,17A '-2026':13A,16A '/api/user/urls':40B,92C '4.5.0':26B,68C 'abus':86C 'allow':76C 'arbitrari':81C 'attack':49B,93C,100C 'attacker-control':48B,99C 'authent':42B,77C 'caus':105C 'contain':69C 'control':50B,101C 'creat':35B 'cve':12A,15A 'destin':11A,51B,84C,104C 'host':22B 'javascript':46B,96C 'let':5A 'link':10A,37B,58B,111C 'malici':8A 'malwar':64B,118C 'miss':87C 'open':3A,72C 'page':65B,119C 'phish':62B,116C 'post':39B,91C 'redirect':4A,73C,114C 'scheme':32B,88C 'self':21B 'self-host':20B 'sent':60B 'set':7A,80C 'short':9A,36B,57B,82C,110C 'store':2A,45B,71C,95C 'trust':56B,109C 'uri':97C 'url':31B,83C,102C 'user':6A,34B,43B,78C 'valid':29B,89C 'visitor':53B,106C 'vulner':74C 'ziplin':1A,23B,24B,66C 'zipline':18A","nicknames":[],"mitigations":[],"who_affected":"Zipline instances before 4.5.0 where users can create short links. Exposure depends on who holds an account, since the flaw requires an authenticated user. Instances where only trusted administrators create links carry much lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["zipline"],"ptokens":["zipline"],"labels":["medium","other","selfhosted","vendor","zipline"],"campaign_type":null,"search_a":"'-126947':14A,17A '-2026':13A,16A 'cve':12A,15A 'destin':11A 'let':5A 'link':10A 'malici':8A 'open':3A 'redirect':4A 'set':7A 'short':9A 'store':2A 'user':6A 'ziplin':1A 'zipline':18A","search_b":"'/api/user/urls':40B '4.5.0':26B 'attack':49B 'attacker-control':48B 'authent':42B 'control':50B 'creat':35B 'destin':51B 'host':22B 'javascript':46B 'link':37B,58B 'malwar':64B 'page':65B 'phish':62B 'post':39B 'scheme':32B 'self':21B 'self-host':20B 'sent':60B 'short':36B,57B 'store':45B 'trust':56B 'url':31B 'user':34B,43B 'valid':29B 'visitor':53B 'ziplin':23B,24B","search_c":"'/api/user/urls':92C '4.5.0':68C 'abus':86C 'allow':76C 'arbitrari':81C 'attack':93C,100C 'attacker-control':99C 'authent':77C 'caus':105C 'contain':69C 'control':101C 'destin':84C,104C 'javascript':96C 'link':111C 'malwar':118C 'miss':87C 'open':72C 'page':119C 'phish':116C 'post':91C 'redirect':73C,114C 'scheme':88C 'set':80C 'short':82C,110C 'store':71C,95C 'trust':109C 'uri':97C 'url':83C,102C 'user':78C 'valid':89C 'visitor':106C 'vulner':74C 'ziplin':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-03-21T18:51:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126947","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126947","severity":null,"published_at":"2026-11-13T10:18:01+00:00","modified_at":"2026-11-13T10:18:01+00:00","first_seen_at":"2026-11-13T10:47:28+00:00","fetched_at":"2026-11-13T10:47:28+00:00","note":null}],"documents":[{"id":145255,"url":"https://github.com/diced/zipline/security/advisories/GHSA-6q69-pgmp-w93c","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-03-21T18:51:59+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145256,"url":"https://www.vulncheck.com/advisories/zipline-before-4.5.0-stored-open-redirect-via-post-api-user-urls","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}