Predictable Filename Vulnerability in Zipline by Diced

CVE-2025-71461

What is CVE-2025-71461?

Zipline versions prior to 4.0.2 are susceptible to a predictable filename vulnerability due to the reliance on the Math.random generator for filename creation. This flaw allows attackers to potentially infer other users' upload filenames by recovering the state of the random generator. By analyzing just five consecutive filenames formatted in a specific style, an attacker can reconstruct the generator’s state, enabling them to predict past and future filenames until the instance is restarted. This vulnerability raises significant privacy concerns as it may expose sensitive user uploads.

References