CVE-2025-71459

CVSS 8.1 (high) · published 2026-11-13

Zipline through 4.3.2 contains a path traversal vulnerability that allows authenticated uploaders to write files outside the upload directory by supplying traversal sequences in the x-zipline-filename header. Attackers using the local datasource can create or overwrite files writable by the Zipline process, corrupting application data or disrupting service.

Weakness: CWE-22

Source: NVD CVE-2025-71459

References

• https://github.com/diced/zipline/security/advisories/GHSA-4jm6-mgwv-fq63
• https://www.vulncheck.com/advisories/zipline-through-4.3.2-path-traversal-via-x-zipline-filename-header

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.