Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2026-126932

Zipline 4.6.2 before 4.8.0 Disabled MIME Type Policy Bypass via File Metadata Update

Zipline 4.6.2 before 4.8.0 contains a policy bypass vulnerability that allows authenticated users to evade administrator-disabled MIME types by editing file metadata. Attackers can upload a permitted file, then set a disabled type such as text/html through PATCH /api/user/files/:id so /raw/:id serves that Content-Type.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Diced
Products
Zipline
CVE-2026-126933

Zipline 4.0.0 before 4.8.0 Disabled Extensions Upload Filter Bypass via Extension Format Mismatch

Zipline 4.0.0 before 4.8.0 contains an upload filter bypass vulnerability that allows users with upload access to store blocked file types due to extension format mismatch. The upload and partial handlers compare dotted, case-sensitive extensions against undotted disabledExtensions entries, letting authenticated or permitted unauthenticated folder uploaders bypass administrator restrictions.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Diced
Products
Zipline
CVE-2026-126934

Zipline 4.3.2 before 4.8.0 Rate Limit Bypass via Spoofed X-Forwarded-For

Zipline 4.3.2 before 4.8.0 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade throttling by spoofing X-Forwarded-For headers when core.trustProxy is enabled. Attackers can send a different X-Forwarded-For value per request to obtain fresh rate-limit buckets, enabling unlimited guessing of login passwords, TOTP codes, and file and URL passwords.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Diced
Products
Zipline
CVE-2026-126935

Zipline before 4.8.0 maxViews Limit Bypass via Race Condition

Zipline before 4.8.0 contains a race condition vulnerability in src/server/routes/raw/[id].ts that allows remote attackers to bypass file maxViews limits through non-atomic view counting. Attackers holding a file link can send parallel requests that read the same pre-increment count, viewing view-limited or delete-on-max-views files beyond their limit.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Diced
Products
Zipline