{"affected":[{"defaultStatus":"unaffected","ecosystem":"github","packageName":"diced/zipline","product":"zipline","source":"CNA: VulnCheck","vendor":"diced","versions":[{"lessThan":"4.8.0","status":"affected","version":"4.0.0","versionType":"semver"}]}],"cveId":"CVE-2026-126933","cwes":["CWE-184"],"description":"Zipline 4.0.0 before 4.8.0 contains an upload filter bypass vulnerability that allows users with upload access to store blocked file types due to extension format mismatch. The upload and partial handlers compare dotted, case-sensitive extensions against undotted disabledExtensions entries, letting authenticated or permitted unauthenticated folder uploaders bypass administrator restrictions.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0"},{"score":4.3,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},{"score":5.3,"severity":"medium","source":"NVD: disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"},{"score":4.3,"severity":"medium","source":"NVD: disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"}],"modifiedAt":1794439043110,"publishedAt":1794437598764,"references":[{"source":"CNA: VulnCheck","tags":["vendor-advisory"],"url":"https://github.com/diced/zipline/security/advisories/GHSA-wwrw-gq56-7wpj"},{"source":"CNA: VulnCheck","tags":["patch"],"url":"https://github.com/diced/zipline/commit/dbc1fe502130a8ebd95fa04886efec01402e5b5f"},{"source":"CNA: VulnCheck","tags":["release-notes"],"url":"https://github.com/diced/zipline/releases/tag/v4.8.0"},{"source":"CNA: VulnCheck","tags":["technical-description"],"url":"https://github.com/diced/zipline/blob/v4.7.0/src/server/routes/api/upload/index.ts#L170"},{"source":"CNA: VulnCheck","tags":["technical-description"],"url":"https://github.com/diced/zipline/blob/v4.7.0/src/server/routes/api/upload/partial.ts#L294"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/zipline-4.0.0-before-4.8.0-disabled-extensions-upload-filter-bypass-via-extension-format-mismatch"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://github.com/diced/zipline/blob/v4.7.0/src/server/routes/api/upload/index.ts#L170"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://github.com/diced/zipline/blob/v4.7.0/src/server/routes/api/upload/partial.ts#L294"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://github.com/diced/zipline/commit/dbc1fe502130a8ebd95fa04886efec01402e5b5f"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://github.com/diced/zipline/releases/tag/v4.8.0"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://github.com/diced/zipline/security/advisories/GHSA-wwrw-gq56-7wpj"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://www.vulncheck.com/advisories/zipline-4.0.0-before-4.8.0-disabled-extensions-upload-filter-bypass-via-extension-format-mismatch"}],"remediation":[{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/diced/zipline/commit/dbc1fe502130a8ebd95fa04886efec01402e5b5f"}],"revision":"d0e0dbe5974790ed159183ef5558ee49efa400193910e691c92ad9d1e2b13d73","sources":[{"modifiedAt":1794437598764,"name":"CNA: VulnCheck","retrievedAt":1794438603429,"url":"https://www.cve.org/CVERecord?id=CVE-2026-126933"},{"modifiedAt":1794439043110,"name":"NVD","retrievedAt":1794443599696,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126933"}],"ssvc":null,"status":"published","title":"Zipline 4.0.0 before 4.8.0 Disabled Extensions Upload Filter Bypass via Extension Format Mismatch","updatedAt":1794443599696}