Zipline

Zipline through 4.4.0 WebAuthn Authentication Bypass via Passkey Login

Zipline before 4.5.1 Stored XSS via HighlightCode Component

Zipline before 4.6.5 TOCTOU Race Condition via /api/setup

Zipline through 3.7.9 Invite Bypass via /api/auth/register Endpoint

Zipline before 4.5.0 IDOR via Folder PATCH and DELETE Endpoints

Zipline 3.4.5 before 3.7.10 Path Traversal via user export endpoint

Zipline through 4.6.2 Privilege Escalation via Missing Role Checks on User Endpoints

Zipline through 4.3.2 Path Traversal via x-zipline-filename Header

Zipline before 4.6.1 Path Traversal via Imported Filenames in LocalDatasource

Zipline before 4.8.0 maxViews Limit Bypass via Race Condition

Zipline before 4.6.4 Upload Quota Bypass via Forged Content-Range Headers

Zipline 4.3.2 before 4.8.0 Rate Limit Bypass via Spoofed X-Forwarded-For

Zipline through 4.4.0 Path Traversal Arbitrary File Delete via x-zipline-file-extension

Zipline through 4.4.0 Path Traversal File Overwrite via PATCH /api/user/files/:id

Zipline before 4.0.2 Predictable Filenames via Math.random State Recovery

Zipline before 4.6.4 Unauthenticated File Listing via page Query Parameter

Zipline before 4.6.4 Rate Limit Bypass via Query String and Header

Zipline 4.2.0 before 4.6.2 OAuth2 Client Secret Leakage in Startup Logs

Zipline through 4.4.0 Authenticated Path Traversal via /api/user/files/:id/raw

Zipline before 3.7.12 XSS via url parameter on login page

Zipline 4.0.0 before 4.8.0 Disabled Extensions Upload Filter Bypass via Extension Format Mismatch

Zipline 4.6.2 before 4.8.0 Disabled MIME Type Policy Bypass via File Metadata Update

Zipline before 4.7.0 Race Condition in Invite and Quota Limits

Zipline before 4.6.2 Missing Authorization via POST /api/user/folders

Zipline 4.3.0 before 4.5.0 Stored XSS via SSR Embed Meta Tags