Information Disclosure in Zipline File Management System

Executive Summary

CVE-2026-126939 is an information disclosure vulnerability in Zipline versions 4.6.3 and earlier. It allows unauthenticated attackers to list files in non-public upload-only folders by exploiting a flaw in the /api/server/folder/:id endpoint. Normally, these folders should only allow file uploads without revealing existing files, but supplying a page query parameter bypasses security checks, causing the server to return full file listings including names, IDs, MIME types, sizes, view counts, and password protection status.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Zipline instance is running version 4.6.3 or earlier. Test the affected endpoint by sending a GET request to /api/server/folder/:id with a known folder UUID and the page query parameter. If file metadata is returned, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to enumerate sensitive file names and metadata in non-public folders without authentication. If an attacker knows or guesses the folder UUID, they can access confidential document names, sizes, and other details, potentially leading to data breaches or further targeted attacks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to sensitive information. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. Unauthorized file enumeration could lead to non-compliance, legal penalties, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Zipline to version 4.6.4 or later immediately. If upgrading is not possible, restrict access to the /api/server/folder/:id endpoint and ensure non-public upload-only folders are properly configured with allowUploads=true and public=false.

Useful 0 Not Useful 0