CVE-2026-126935

LOW 3.7

Zipline before 4.8.0 maxViews Limit Bypass via Race Condition

CVSS Score

3.7

EPSS Score

0.0%

EPSS Percentile

0th

Zipline before 4.8.0 contains a race condition vulnerability in src/server/routes/raw/[id].ts that allows remote attackers to bypass file maxViews limits through non-atomic view counting. Attackers holding a file link can send parallel requests that read the same pre-increment count, viewing view-limited or delete-on-max-views files beyond their limit.

CWE	CWE-367
Vendor	diced
Product	zipline
Published	Nov 11, 2026

Stay Ahead of the Next One

Get instant alerts for diced zipline

Be the first to know when new low vulnerabilities affecting diced zipline are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

diced / zipline

0 < 4.8.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/diced/zipline/security/advisories/GHSA-7xv9-wr46-j578 github.com: https://github.com/diced/zipline/commit/1770479d6795ea8700f0ce6ba08a1654d3644c73 github.com: https://github.com/diced/zipline/releases/tag/v4.8.0 github.com: https://github.com/diced/zipline/blob/v4.7.0/src/server/routes/raw/%5Bid%5D.ts#L101-L133 vulncheck.com: https://www.vulncheck.com/advisories/zipline-before-4.8.0-maxviews-limit-bypass-via-race-condition

Credits

Sandipkumar sah