CVE-2025-71461

CVSS 6.9 (medium) · published 2026-11-13

Zipline before 4.0.2 contains a predictable filename vulnerability that allows attackers to infer other users' upload filenames by recovering the Math.random generator state. Attackers with five consecutive gfycat-style filenames can reconstruct the random state to predict previous and future filenames until the instance restarts, exposing private uploads.

Weakness: CWE-338

Source: NVD CVE-2025-71461

References

• https://github.com/diced/zipline/security/advisories/GHSA-6rg9-q9ww-w2rw
• https://www.vulncheck.com/advisories/zipline-before-4.0.2-predictable-filenames-via-math-random-state-recovery

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.