CVE-2025-71461: Zipline before 4.0.2 Predictable Filenames via Math.random State Recovery
Zipline before 4.0.2 contains a predictable filename vulnerability that allows attackers to infer other users' upload filenames by recovering the Math.random generator state. Attackers with five consecutive gfycat-style filenames can reconstruct the random state to predict previous and future filenames until the instance restarts, exposing private uploads.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Zipline instances running versions before 4.0.2 are affected when they use gfycat-style upload filenames. The issue can expose private uploads by making their filenames predictable.
What does an attacker need to exploit this?
An attacker needs five consecutive gfycat-style filenames. They can use those filenames to reconstruct the Math.random generator state and predict upload filenames generated before and after the observed sequence.
How long can filename prediction remain possible?
Predictions remain possible until the affected Zipline instance restarts. A restart resets the generator state, ending predictions based on the previously recovered state.