Upload Filter Bypass Vulnerability in Zipline by Diced

CVE-2026-126933

What is CVE-2026-126933?

Zipline versions prior to 4.8.0 are susceptible to an upload filter bypass vulnerability. This issue arises when users with upload permissions are able to store file types that should be restricted due to an extension format mismatch. Specifically, the vulnerability is linked to how the upload and partial handlers process file extensions, comparing case-sensitive extensions against undotted entries in the disabledExtensions list. As a result, both authenticated users and those granted unauthenticated folder upload capabilities may circumvent restrictions put in place by administrators, potentially leading to unauthorized file uploads.

References