中 4.2

Zipline before 4.2.1 Missing Ownership Check via /api/user/files/transaction

CVE-2025-71460 SecPulse初出 18:37

概要

Zipline before 4.2.1 contains a missing authorization vulnerability in the /api/user/files/transaction endpoint that allows authenticated users to modify other users' files due to absent ownership checks. Attackers who know a target file ID can submit transaction requests to edit or delete files bel...

影響パッケージ

種類	パッケージ	影響を受ける版 → 修正版	修正版
diced	dicedzipline	4.2.1 未満→ 4.2.1	4.2.1

原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。

Zipline before 4.2.1 contains a missing authorization vulnerability in the /api/user/files/transaction endpoint that allows authenticated users to modify other users' files due to absent ownership checks. Attackers who know a target file ID can submit transaction requests to edit or delete files belonging to any user.

出典: CVE.org (CVE Program・cvelistV5) NVD

参照URL

• advisory GitHub Security Advisory (GHSA-26wv-mhc3-5xfq)
• advisory VulnCheck Advisory: Zipline before 4.2.1 Missing Ownership Check via /api/user/files/transaction