CVE-2026-126933— Zipline 4.0.0 before 4.8.0 Disabled Extensions Upload Filter Bypass via Extension Format Mismatch

Quick assessment

Affected

diced zipline

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Zipline 4.0.0 至 4.8.0 之前的版本存在一个上传过滤绕过漏洞。该漏洞允许拥有上传权限的用户，因文件扩展名格式不匹配而存储被禁止的文件类型。具体而言，上传处理器和部分文件处理器将带点且区分大小写的扩展名与不带点的条目进行比较，导致已认证用户或被允许的非认证文件夹上传者能够绕过管理员设定的限制。

CVSS 4.3 · Medium Updated Nov 12, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Zipline 4.0.0 before 4.8.0 Disabled Extensions Upload Filter Bypass via Extension Format Mismatch

Source: CVE Program / CVE List V5

Vulnerability Description

Zipline 4.0.0 before 4.8.0 contains an upload filter bypass vulnerability that allows users with upload access to store blocked file types due to extension format mismatch. The upload and partial handlers compare dotted, case-sensitive extensions against undotted disabledExtensions entries, letting authenticated or permitted unauthenticated folder uploaders bypass administrator restrictions.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

不完整的黑名单

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
diced	zipline	4.0.0 ~ 4.8.0	-

II. Public POCs for CVE-2026-126933

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-126933

请登录查看更多情报信息。

Other References for CVE-2026-126933 (6)

https://github.com/diced/zipline/blob/v4.7.0/src/server/routes/api/upload/index.ts#L170 technical-description
https://github.com/diced/zipline/commit/dbc1fe502130a8ebd95fa04886efec01402e5b5f patch
https://github.com/diced/zipline/blob/v4.7.0/src/server/routes/api/upload/partial.ts#L294 technical-description
https://github.com/diced/zipline/releases/tag/v4.8.0 release-notes
https://github.com/diced/zipline/security/advisories/GHSA-wwrw-gq56-7wpj vendor-advisory
https://www.vulncheck.com/advisories/zipline-4.0.0-before-4.8.0-disabled-extensions-upload-filter-bypass-via-extension-format-mismatch third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-126933

Same Patch Batch · diced · 2026-11-11 · 4 CVEs total

CVE-2026-126934	6.5 MEDIUM	Zipline 4.3.2 before 4.8.0 Rate Limit Bypass via Spoofed X-Forwarded-For
CVE-2026-126932	4.3 MEDIUM	Zipline 4.6.2 before 4.8.0 Disabled MIME Type Policy Bypass via File Metadata Update
CVE-2026-126935	3.7 LOW	Zipline before 4.8.0 maxViews Limit Bypass via Race Condition

IV. Related Vulnerabilities

Same product: zipline

Same vendor: diced

Same weakness: CWE-184