CVE-2026-126944: Zipline before 4.6.1 Path Traversal via Imported Filenames in LocalDatasource
Zipline before 4.6.1 contains a path traversal vulnerability in LocalDatasource that allows SUPERADMIN users to read or delete files outside the upload directory by importing records with traversal filenames. Attackers can trigger the unchecked range-read path with byte-range requests or set expired deletion times to delete files accessible to the Zipline process.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires SUPERADMIN privileges in Zipline. The attacker must be able to import records with filenames containing path-traversal sequences.
What impact is possible?
A SUPERADMIN can read files outside the upload directory through the unchecked range-read path using byte-range requests. They can also delete files accessible to the Zipline process by setting expired deletion times.
Are default deployments affected?
The provided information does not state whether the vulnerable LocalDatasource configuration is enabled by default. A deployment is exposed when it uses an affected Zipline version and permits a SUPERADMIN to import crafted filenames.
What version fixes the issue?
Zipline 4.6.1 fixes this vulnerability. Versions before 4.6.1 are affected.