中
5.3
Zipline 4.0.0 before 4.8.0 Disabled Extensions Upload Filter Bypass via Extension Format Mismatch
CVE-2026-126933
SecPulse初出
影響パッケージ
| パッケージ | 影響を受ける版 → 修正版 | |
|---|---|---|
| dicedzipline |
4.0.0 以上 4.8.0 未満→ 4.8.0 |
4.8.0 |
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
Zipline 4.0.0 before 4.8.0 contains an upload filter bypass vulnerability that allows users with upload access to store blocked file types due to extension format mismatch. The upload and partial handlers compare dotted, case-sensitive extensions against undotted disabledExtensions entries, letting authenticated or permitted unauthenticated folder uploaders bypass administrator restrictions.
出典: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
参照URL
- advisory nvd.nist.gov
- advisory github.com
- web disclosure@vulncheck.com
- web disclosure@vulncheck.com
- web disclosure@vulncheck.com
- web disclosure@vulncheck.com
- web disclosure@vulncheck.com
- web disclosure@vulncheck.com
- web github.com