CVE-2026-126950: Zipline through 4.4.0 Path Traversal Arbitrary File Delete via x-zipline-file-extension
Zipline through 4.4.0 contains a path traversal vulnerability that allows authenticated attackers to delete arbitrary server files by injecting traversal sequences via the x-zipline-file-extension header. Attackers can upload a file with a poisoned stored name and short expiry so LocalDatasource deletion removes chosen files, causing denial of service or data loss.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to upload a file and supply a malicious x-zipline-file-extension header. The issue can be used to cause denial of service or data loss by deleting server files.
What conditions are needed for arbitrary file deletion?
The attacker uploads a file with a poisoned stored name containing traversal sequences and sets a short expiry. When LocalDatasource processes deletion of the expired upload, it can remove attacker-chosen server files.
Which deployments are exposed?
Deployments using LocalDatasource are implicated because the vulnerable deletion behavior occurs when LocalDatasource removes an expired upload. The provided information identifies Zipline versions through 4.4.0 as affected.