Policy Bypass in Zipline Web Application by Diced

CVE-2026-126932

What is CVE-2026-126932?

A policy bypass vulnerability exists in Zipline versions 4.6.2 before 4.8.0, enabling authenticated users to circumvent administrator-disabled MIME types. This is achieved by modifying file metadata, which allows the upload of files with disallowed content types, such as text/html, through targeted API requests. This exploitation can lead to serving malicious content under the guise of permitted files, thereby posing potential security risks to users and systems relying on Zipline.

References