Path Traversal Vulnerability in Zipline by Diced

CVE-2024-58404

What is CVE-2024-58404?

Zipline versions from 3.4.5 prior to 3.7.10 are susceptible to a path traversal vulnerability found in the user data export endpoint. When exploited, authenticated attackers can circumvent the user ID verification checks and leverage directory traversal sequences to access arbitrary files stored on the server. This flaw poses a threat to data confidentiality and can lead to unauthorized information disclosure.

References