CVE-2026-126944

CVSS 5.8 (medium) · published 2026-11-13

Zipline before 4.6.1 contains a path traversal vulnerability in LocalDatasource that allows SUPERADMIN users to read or delete files outside the upload directory by importing records with traversal filenames. Attackers can trigger the unchecked range-read path with byte-range requests or set expired deletion times to delete files accessible to the Zipline process.

Weakness: CWE-22

Source: NVD CVE-2026-126944

References

• https://github.com/diced/zipline/security/advisories/GHSA-gr35-qcpp-65w5
• https://www.vulncheck.com/advisories/zipline-before-4.6.1-path-traversal-via-imported-filenames-in-localdatasource

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.