MEDIUMCVSS v3.1 4.3Vulnerability
CVE-2026-126933
Zipline 4.0.0 before 4.8.0 contains an upload filter bypass vulnerability that allows users with upload access to store blocked file types due to extension format mismatch. The upload and partial handlers compare dotted, case-sensitive extensions against undotted disabledExtensions entries, letting authenticated or permitted unauthenticated folder uploaders bypass administrator restrictions.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-11-11T23:49:45.533241+00:00
- Cvss severity
- MEDIUM
- Cvss score
- 4.3
- Retrieved at
- 2026-11-11T23:50:19+00:00
- Score
- 4.3
- Cvss version
- 3.1
- Last source
- NVD
- Cve id
- CVE-2026-126933
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- First seen by Signal
- 2026-11-11T23:46:42+00:00
- Name
- CVE-2026-126933
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Published at
- 2026-11-11T23:17:23.110
- Last modified
- 2026-11-11T23:17:23.110
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph