CVE-2025-71459: Zipline through 4.3.2 Path Traversal via x-zipline-filename Header
Zipline through 4.3.2 contains a path traversal vulnerability that allows authenticated uploaders to write files outside the upload directory by supplying traversal sequences in the x-zipline-filename header. Attackers using the local datasource can create or overwrite files writable by the Zipline process, corrupting application data or disrupting service.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Zipline instances through 4.3.2 are exposed where authenticated users can upload files using the local datasource. The attacker must have uploader-level authentication.
What does an attacker need to exploit it?
An authenticated uploader can supply path-traversal sequences in the x-zipline-filename request header while using the local datasource. No user interaction is required.
What can an attacker do after exploiting the flaw?
The attacker can create or overwrite files outside the intended upload directory, limited to locations writable by the Zipline process. This can corrupt application data or disrupt service.