CVE-2026-126949: Zipline through 4.4.0 Path Traversal File Overwrite via PATCH /api/user/files/:id
Zipline through 4.4.0 contains a path traversal vulnerability in the PATCH /api/user/files/:id rename endpoint that allows authenticated users to overwrite existing uploads by supplying unsanitized names. Attackers can submit names like ../uploads/victim.txt that bypass the raw-string database uniqueness check but normalize via path.join(), causing fs.rename() to replace other files' contents.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user can exploit it. The provided data does not indicate that any additional privileges or user interaction are required.
What does an attacker need to send to trigger the overwrite?
The attacker needs to call PATCH /api/user/files/:id and supply a crafted rename value containing path traversal sequences, such as ../uploads/victim.txt. The raw name can bypass the database uniqueness check and then normalize when processed by path.join().
What is the impact of a successful exploit?
A successful exploit can overwrite the contents of an existing uploaded file when fs.rename() replaces the target file. The supplied severity data indicates integrity impact is high and availability impact is low.
How can I determine whether an instance is affected?
The issue is described as affecting Zipline through version 4.4.0. Review whether your deployment exposes the authenticated PATCH /api/user/files/:id rename endpoint and uses the affected version range.