Description
Zipline through 4.4.0 contains a path traversal vulnerability that allows authenticated attackers to delete arbitrary server files by injecting traversal sequences via the x-zipline-file-extension header. Attackers can upload a file with a poisoned stored name and short expiry so LocalDatasource deletion removes chosen files, causing denial of service or data loss.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| diced | zipline | 0 ≤4.4.0 | — |