CVE-2026-126935— Zipline before 4.8.0 maxViews Limit Bypass via Race Condition

Quick assessment

Affected

diced zipline

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 4.8.0 版本之前的 Zipline 中，文件存在一个竞态条件漏洞。由于视图计数操作不具备原子性，远程攻击者可以绕过文件的最大查看次数限制。持有文件链接的攻击者能够发送并行请求，这些请求会读取相同的预递增计数值，从而使得受查看次数限制或达到最大查看次数后自动删除的文件被超出限制地查看。

CVSS 3.7 · Low Updated Nov 12, 2026

Possible ATT&CK Techniques 2 AI

T1078 · Valid Accounts T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Zipline before 4.8.0 maxViews Limit Bypass via Race Condition

Source: CVE Program / CVE List V5

Vulnerability Description

Zipline before 4.8.0 contains a race condition vulnerability in src/server/routes/raw/[id].ts that allows remote attackers to bypass file maxViews limits through non-atomic view counting. Attackers holding a file link can send parallel requests that read the same pre-increment count, viewing view-limited or delete-on-max-views files beyond their limit.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

检查时间与使用时间(TOCTOU)的竞争条件

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
diced	zipline	0 ~ 4.8.0	-

II. Public POCs for CVE-2026-126935

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-126935

请登录查看更多情报信息。

Other References for CVE-2026-126935 (5)

https://github.com/diced/zipline/commit/1770479d6795ea8700f0ce6ba08a1654d3644c73 patch
https://github.com/diced/zipline/blob/v4.7.0/src/server/routes/raw/%5Bid%5D.ts#L101-L133 technical-description
https://github.com/diced/zipline/releases/tag/v4.8.0 release-notes
https://github.com/diced/zipline/security/advisories/GHSA-7xv9-wr46-j578 vendor-advisory
https://www.vulncheck.com/advisories/zipline-before-4.8.0-maxviews-limit-bypass-via-race-condition third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-126935

Same Patch Batch · diced · 2026-11-11 · 4 CVEs total

CVE-2026-126934	6.5 MEDIUM	Zipline 4.3.2 before 4.8.0 Rate Limit Bypass via Spoofed X-Forwarded-For
CVE-2026-126933	4.3 MEDIUM	Zipline 4.0.0 before 4.8.0 Disabled Extensions Upload Filter Bypass via Extension Format M
CVE-2026-126932	4.3 MEDIUM	Zipline 4.6.2 before 4.8.0 Disabled MIME Type Policy Bypass via File Metadata Update

IV. Related Vulnerabilities

Same product: zipline

Same vendor: diced

Same weakness: CWE-367