CVE-2026-126951

UNKNOWN 0.0

Zipline through 4.4.0 Authenticated Path Traversal via /api/user/files/:id/raw

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Zipline through 4.4.0 contains a path traversal vulnerability that allows authenticated users to read arbitrary server files by abusing a fallback treating the :id parameter as a datasource key. Attackers can send encoded traversal sequences in the :id of GET /api/user/files/:id/raw to escape the Local datasource uploads directory and read files like /etc/shadow.

CWE	CWE-22
Vendor	diced
Product	zipline
Published	Nov 13, 2026

Stay Ahead of the Next One

Get instant alerts for diced zipline

Be the first to know when new unknown vulnerabilities affecting diced zipline are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

diced / zipline

0 ≤ 4.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/diced/zipline/security/advisories/GHSA-8xjg-qm2p-75gm vulncheck.com: https://www.vulncheck.com/advisories/zipline-through-4.4.0-authenticated-path-traversal-via-api-user-files-id-raw

Credits

🔍 nojomyth-dev