CVE-2026-126939: Zipline before 4.6.4 Unauthenticated File Listing via page Query Parameter
Zipline before 4.6.4 contains an information disclosure vulnerability in GET /api/server/folder/:id that allows unauthenticated attackers to list files in non-public upload-only folders. Attackers who know the folder UUID can supply the page query parameter to bypass the metadata-only early return and enumerate file names, IDs, MIME types, sizes, and view counts.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Zipline versions before 4.6.4 are affected where non-public upload-only folders exist. Public access is not required, but the attacker must know the target folder's UUID.
What does an attacker need to do to retrieve the file listing?
An unauthenticated attacker can request GET /api/server/folder/:id for a known folder UUID and include the page query parameter. This bypasses the metadata-only early return and exposes file metadata.
What information can be disclosed?
The attacker can enumerate file names, IDs, MIME types, sizes, and view counts for files in the affected folder.
Does this require credentials or user interaction?
No. The vulnerability is exploitable remotely without authentication, privileges, or user interaction.