CVE-2026-126933: Zipline 4.0.0 before 4.8.0 Disabled Extensions Upload Filter Bypass via Extension Format Mismatch
Zipline 4.0.0 before 4.8.0 contains an upload filter bypass vulnerability that allows users with upload access to store blocked file types due to extension format mismatch. The upload and partial handlers compare dotted, case-sensitive extensions against undotted disabledExtensions entries, letting authenticated or permitted unauthenticated folder uploaders bypass administrator restrictions.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ziplineto a version that resolves this vulnerability.Fixed in 4.8.0
Event History
Frequently Asked Questions
Which users can exploit this issue?
The issue is exploitable by authenticated users with upload access and by unauthenticated users who have been permitted to upload to a folder.
Are all uploads affected?
The bypass affects both the upload handler and the partial upload handler. It is relevant where administrators rely on disabledExtensions to block particular file types.
What configuration detail enables the bypass?
The affected handlers compare dotted, case-sensitive uploaded extensions against undotted disabledExtensions entries. This format mismatch can allow blocked file types to be stored despite the configured restriction.