diced Zipline up to 4.4.0 Rename /api/user/files fs.rename id/name path traversal

Summaryinfo

A vulnerability classified as critical has been found in diced Zipline up to 4.4.0. This affects the function fs.rename of the file /api/user/files of the component Rename. Performing a manipulation of the argument id/name results in path traversal. This vulnerability is identified as CVE-2026-126949. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in diced Zipline up to 4.4.0. It has been classified as critical. This affects the function fs.rename of the file /api/user/files of the component Rename. The manipulation of the argument id/name with an unknown input leads to a path traversal vulnerability. CWE is classifying the issue as CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Zipline through 4.4.0 contains a path traversal vulnerability in the PATCH /api/user/files/:id rename endpoint that allows authenticated users to overwrite existing uploads by supplying unsanitized names. Attackers can submit names like ../uploads/victim.txt that bypass the raw-string database uniqueness check but normalize via path.join(), causing fs.rename() to replace other files' contents.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-126949 since 11/11/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 11/13/2026). The attack technique deployed by this issue is T1006 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• diced

Name

• Zipline

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4.0

Website

• Product: https://github.com/diced/zipline/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion