Path Traversal in Zipline through 4.3.2

Executive Summary

CVE-2025-71459 is a path traversal vulnerability in Zipline through version 4.3.2. It allows authenticated users with upload access to write or read files outside the intended upload directory by supplying traversal sequences in the x-zipline-filename header. The flaw occurs because the filename override is decoded and joined to the upload directory without proper containment checks.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if Zipline is running version 4.3.2 or earlier. Inspect network traffic for requests containing the x-zipline-filename header with path traversal sequences like ../. Use tools like curl to test if file writes occur outside the upload directory by sending crafted requests with traversal paths.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can corrupt application data, disrupt service, or lead to code execution if an attacker writes a file that the system later executes. Attackers can create or overwrite files writable by the Zipline process, potentially causing significant operational or security issues.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Zipline to version 4.4.0 or later to apply the patch. If upgrading is not possible, restrict write permissions for the Zipline process user and disable the local datasource feature. Monitor for unauthorized file writes or modifications in system directories.

Useful 0 Not Useful 0