CVE-2026-126935: Zipline before 4.8.0 maxViews Limit Bypass via Race Condition
Zipline before 4.8.0 contains a race condition vulnerability in src/server/routes/raw/[id].ts that allows remote attackers to bypass file maxViews limits through non-atomic view counting. Attackers holding a file link can send parallel requests that read the same pre-increment count, viewing view-limited or delete-on-max-views files beyond their limit.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any remote party that holds a link to a file protected by a maxViews limit can attempt exploitation. No authentication or user interaction is required, but the attacker must send parallel requests.
Which files are affected?
Files configured with a view limit, including files set to be deleted when their maximum view count is reached, are affected. The race can allow views beyond the configured limit.
What configuration condition is required for exploitation?
The affected file must have a maxViews limit configured and its link must be available to the attacker. Files without a view limit are not implicated by the described bypass.
What version resolves the issue?
Zipline 4.8.0 resolves the issue. Versions before 4.8.0 are affected.