CVE-2026-126950

UNKNOWN 0.0

Zipline through 4.4.0 Path Traversal Arbitrary File Delete via x-zipline-file-extension

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Zipline through 4.4.0 contains a path traversal vulnerability that allows authenticated attackers to delete arbitrary server files by injecting traversal sequences via the x-zipline-file-extension header. Attackers can upload a file with a poisoned stored name and short expiry so LocalDatasource deletion removes chosen files, causing denial of service or data loss.

CWE	CWE-22
Vendor	diced
Product	zipline
Published	Nov 13, 2026

Stay Ahead of the Next One

Get instant alerts for diced zipline

Be the first to know when new unknown vulnerabilities affecting diced zipline are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

diced / zipline

0 ≤ 4.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/diced/zipline/security/advisories/GHSA-2wfm-prg7-x586 vulncheck.com: https://www.vulncheck.com/advisories/zipline-through-4.4.0-path-traversal-arbitrary-file-delete-via-x-zipline-file-extension

Credits

🔍 nojomyth-dev