CVE-2026-126933

CVSS 5.3 (medium) · published 2026-11-11

Zipline 4.0.0 before 4.8.0 contains an upload filter bypass vulnerability that allows users with upload access to store blocked file types due to extension format mismatch. The upload and partial handlers compare dotted, case-sensitive extensions against undotted disabledExtensions entries, letting authenticated or permitted unauthenticated folder uploaders bypass administrator restrictions.

Weakness: CWE-184

Source: NVD CVE-2026-126933

References

• https://github.com/diced/zipline/blob/v4.7.0/src/server/routes/api/upload/index.ts#L170
• https://github.com/diced/zipline/blob/v4.7.0/src/server/routes/api/upload/partial.ts#L294
• https://github.com/diced/zipline/commit/dbc1fe502130a8ebd95fa04886efec01402e5b5f
• https://github.com/diced/zipline/releases/tag/v4.8.0
• https://github.com/diced/zipline/security/advisories/GHSA-wwrw-gq56-7wpj
• https://www.vulncheck.com/advisories/zipline-4.0.0-before-4.8.0-disabled-extensions-upload-filter-bypass-via-extension-format-mismatch

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.