CVE-2024-58404

CVSS 8.3 (high) · published 2026-11-13

Zipline versions from 3.4.5 before 3.7.10 contain a path traversal vulnerability in the user data export endpoint via the name query parameter. Authenticated attackers can bypass the user id check and use directory traversal sequences to read arbitrary files on the server host.

Weakness: CWE-22

Source: NVD CVE-2024-58404

References

• https://github.com/diced/zipline/security/advisories/GHSA-v38v-92cm-6mx8
• https://www.vulncheck.com/advisories/zipline-3.4.5-before-3.7.10-path-traversal-via-user-export-endpoint

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.