CVE-2026-126951: Zipline through 4.4.0 Authenticated Path Traversal via /api/user/files/:id/raw
Zipline through 4.4.0 contains a path traversal vulnerability that allows authenticated users to read arbitrary server files by abusing a fallback treating the :id parameter as a datasource key. Attackers can send encoded traversal sequences in the :id of GET /api/user/files/:id/raw to escape the Local datasource uploads directory and read files like /etc/shadow.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user can exploit it. The attack is performed by sending encoded path-traversal sequences in the id parameter of a GET request to /api/user/files/:id/raw.
Are installations using the Local datasource exposed?
The vulnerable fallback can treat the id parameter as a datasource key and escape the Local datasource uploads directory. This can allow reading arbitrary files accessible to the server process, including files such as /etc/shadow.
What is the impact of successful exploitation?
Successful exploitation exposes file contents on the server. The provided impact information indicates high confidentiality impact, with no indicated integrity or availability impact.