CVE-2026-126949

UNKNOWN 0.0

Zipline through 4.4.0 Path Traversal File Overwrite via PATCH /api/user/files/:id

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Zipline through 4.4.0 contains a path traversal vulnerability in the PATCH /api/user/files/:id rename endpoint that allows authenticated users to overwrite existing uploads by supplying unsanitized names. Attackers can submit names like ../uploads/victim.txt that bypass the raw-string database uniqueness check but normalize via path.join(), causing fs.rename() to replace other files' contents.

CWE	CWE-22
Vendor	diced
Product	zipline
Published	Nov 13, 2026

Stay Ahead of the Next One

Get instant alerts for diced zipline

Be the first to know when new unknown vulnerabilities affecting diced zipline are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

diced / zipline

0 ≤ 4.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/diced/zipline/security/advisories/GHSA-rw9m-7mvm-6gxp vulncheck.com: https://www.vulncheck.com/advisories/zipline-through-4.4.0-path-traversal-file-overwrite-via-patch-api-user-files-id

Credits

🔍 nojomyth-dev