zipline at a glance
- Last 12 months
- 26
- Critical · all time
- 0
- Exploited · all time
- 0
- Public exploit · all time
- 0
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 26 | 0 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 0 | 0 |
| Aug 2026 | 0 | 0 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 0 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
26 results · Feed
-
High 8.6
Zipline through 3.7.9 Invite Bypass via /api/auth/register Endpoint
Zipline through 3.7.9 contains an improper authorization vulnerability in the /api/auth/register endpoint, which enforces invite codes only when user registration is disabled, so registration succeeds without an invite when both invites and user registration …
-
High 8.3
Zipline versions from 3.4.5 before 3.7.10 contain a path traversal vulnerability in the user data export endpoint via t…
-
High 8.1
Zipline through 4.3.2 Path Traversal via x-zipline-filename Header
Zipline through 4.3.2 contains a path traversal vulnerability that allows authenticated uploaders to write files outside the upload directory by supplying traversal sequences in the x-zipline-filename header. Attackers using the local datasource can create or…
-
Low 2.3
Zipline before 4.2.1 contains a missing authorization vulnerability in the /api/user/files/transaction endpoint that al…
-
Medium 6.1
Zipline before 3.7.12 XSS via url parameter on login page
Zipline before 3.7.12 contains a cross-site scripting vulnerability in the login page that allows attackers to execute JavaScript by supplying an unvalidated url parameter. Attackers can craft a login link with a javascript: URI in the url parameter that exec…
-
Medium 6.0
Zipline before 4.7.0 contains a race condition vulnerability that allows users to bypass invitation usage limits, uploa…
-
High 8.1
Zipline before 4.6.5 TOCTOU Race Condition via /api/setup
Zipline before 4.6.5 contains a TOCTOU race condition in the POST /api/setup endpoint that allows unauthenticated attackers to create multiple SUPERADMIN accounts by racing concurrent requests before the firstSetup flag is reset. Attackers can send simultaneo…
-
Medium 6.9
Zipline before 4.6.4 contains an information disclosure vulnerability in GET /api/server/folder/:id that allows unauthe…
-
High 7.1
Zipline before 4.6.4 Upload Quota Bypass via Forged Content-Range Headers
Zipline before 4.6.4 contains a resource allocation vulnerability that allows authenticated users to bypass chunked-upload size and quota checks by forging Content-Range offsets and totals. Attackers can send tiny chunks to the partial upload endpoint with la…
-
Medium 6.9
Zipline before 4.6.4 contains a rate limit bypass vulnerability that allows remote attackers to evade request limits by…
-
Medium 5.4
Zipline before 4.6.2 Missing Authorization via POST /api/user/folders
Zipline before 4.6.2 contains a missing authorization vulnerability in POST /api/user/folders that allows authenticated users to reparent other users' files by supplying their file IDs. Attackers can harvest file IDs from public folders and create a folder se…
-
Medium 6.8
Zipline through 4.6.2 Privilege Escalation via Missing Role Checks on User Endpoints
Zipline through 4.6.2 contains an authorization bypass vulnerability that allows authenticated administrators to read superadmin secrets because GET /api/users and GET /api/users/:id lack the canInteract check. Attackers can retrieve plaintext totpSecret and …
-
Medium 6.9
Zipline from 4.2.0 before 4.6.2 contains an information disclosure vulnerability that logs sensitive environment variab…
-
High 8.7
Zipline before 4.5.1 Stored XSS via HighlightCode Component
Zipline before 4.5.1 contains a stored cross-site scripting vulnerability in the HighlightCode component that renders unescaped file content before highlight.js finishes loading. Authenticated attackers can upload text files containing HTML/JavaScript payload…
-
Medium 5.8
Zipline before 4.6.1 contains a path traversal vulnerability in LocalDatasource that allows SUPERADMIN users to read or…
-
Medium 5.4
Zipline 4.3.0 before 4.5.0 Stored XSS via SSR Embed Meta Tags
Zipline from 4.3.0 before 4.5.0 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject HTML through unescaped embed settings in SSR meta tags. Attackers can set malicious embedTitle, embedDescription, embe…
-
High 8.8
Zipline before 4.5.0 IDOR via Folder PATCH and DELETE Endpoints
Zipline before 4.5.0 contains an insecure direct object reference vulnerability caused by missing ownership verification in the PATCH and DELETE handlers for /api/user/folders/:id. Authenticated attackers can supply another user's folder ID to rename it, make…
-
Medium 5.4
Zipline before 4.5.0 Stored Open Redirect via POST /api/user/urls
Zipline before 4.5.0 contains a stored open redirect vulnerability that allows authenticated users to set arbitrary short URL destinations by abusing missing scheme validation in POST /api/user/urls. Attackers can store javascript: URIs or attacker-controlled…
-
High 7.0
Zipline through 4.4.0 contains a path traversal vulnerability in the PATCH /api/user/files/:id rename endpoint that all…
-
High 7.0
Zipline through 4.4.0 contains a path traversal vulnerability that allows authenticated attackers to delete arbitrary s…
-
High 8.1
Zipline through 4.4.0 WebAuthn Authentication Bypass via Passkey Login
Zipline through 4.4.0 contains an authentication bypass vulnerability in the WebAuthn login endpoint that creates sessions for a supplied registered credential ID without verifying the assertion. Attackers who obtain a target's passkey credential ID can imper…
-
Medium 6.9
Zipline through 4.4.0 Authenticated Path Traversal via /api/user/files/:id/raw
Zipline through 4.4.0 contains a path traversal vulnerability that allows authenticated users to read arbitrary server files by abusing a fallback treating the :id parameter as a datasource key. Attackers can send encoded traversal sequences in the :id of GET…
-
Low 3.7
Zipline before 4.8.0 maxViews Limit Bypass via Race Condition
Zipline before 4.8.0 contains a race condition vulnerability in src/server/routes/raw/[id].ts that allows remote attackers to bypass file maxViews limits through non-atomic view counting. Attackers holding a file link can send parallel requests that read the …
-
Medium 6.5
Zipline 4.3.2 before 4.8.0 Rate Limit Bypass via Spoofed X-Forwarded-For
Zipline 4.3.2 before 4.8.0 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade throttling by spoofing X-Forwarded-For headers when core.trustProxy is enabled. Attackers can send a different X-Forwarded-For value per reque…
-
Medium 4.3
Zipline 4.0.0 before 4.8.0 Disabled Extensions Upload Filter Bypass via Extension Format Mismatch
Zipline 4.0.0 before 4.8.0 contains an upload filter bypass vulnerability that allows users with upload access to store blocked file types due to extension format mismatch. The upload and partial handlers compare dotted, case-sensitive extensions against undo…
-
Medium 4.3
Zipline 4.6.2 before 4.8.0 Disabled MIME Type Policy Bypass via File Metadata Update
Zipline 4.6.2 before 4.8.0 contains a policy bypass vulnerability that allows authenticated users to evade administrator-disabled MIME types by editing file metadata. Attackers can upload a permitted file, then set a disabled type such as text/html through PA…