Medium 5.3

Zipline 4.0.0 before 4.8.0 Disabled Extensions Upload Filter Bypass via Extension Format Mismatch

CVE-2026-126933 First seen on SecPulse Nov 12, 07:53

Affected packages

Ecosystem	Package	Affected → Fixed	Fixed
diced	dicedzipline	≥ 4.0.0, < 4.8.0→ 4.8.0	4.8.0

Original description The description as published by the source.

Zipline 4.0.0 before 4.8.0 contains an upload filter bypass vulnerability that allows users with upload access to store blocked file types due to extension format mismatch. The upload and partial handlers compare dotted, case-sensitive extensions against undotted disabledExtensions entries, letting authenticated or permitted unauthenticated folder uploaders bypass administrator restrictions.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 4.3; CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4: Medium 5.3; CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Published: Nov 12, 2026
First seen on SecPulse: Nov 12, 07:53
GHSA: GHSA-wwrw-gq56-7wpj
CWE: CWE-184

NVD GitHub Advisory

Tags(click for explanation)

CWE

CWE-184

All

Diced Zipline

Detection sources

OSV.dev (Open Source Vulnerabilities)11:47
NIST National Vulnerability Database11:18
GitHub Security Advisories (Global)Nov 12, 09:33
CVE.org (CVE Program・cvelistV5)09:02