CVE-2026-126932: Zipline 4.6.2 before 4.8.0 Disabled MIME Type Policy Bypass via File Metadata Update
Zipline 4.6.2 before 4.8.0 contains a policy bypass vulnerability that allows authenticated users to evade administrator-disabled MIME types by editing file metadata. Attackers can upload a permitted file, then set a disabled type such as text/html through PATCH /api/user/files/:id so /raw/:id serves that Content-Type.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ziplineto a version that resolves this vulnerability.Fixed in 4.8.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Zipline user can exploit it. The attacker needs permission to upload a permitted file and to update that file's metadata through the file API.
Are deployments affected if administrators have disabled risky MIME types?
Yes. The issue specifically bypasses administrator-disabled MIME type policies by changing an uploaded file's metadata after upload, causing the raw file endpoint to serve the attacker-selected Content-Type.
What versions are affected and what is the fix?
Zipline 4.6.2 through versions before 4.8.0 are affected. Upgrade to version 4.8.0 or later.
How can I check for attempted or successful exploitation?
Review requests to PATCH /api/user/files/:id for metadata changes that set MIME types disabled by your policy, particularly text/html. Also identify files whose Content-Type served through /raw/:id conflicts with the type permitted at upload time.