CVE-2026-126935

Published: Nov 11, 2026Modified: Nov 13, 2026Deferred

6.3

Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

Zipline before 4.8.0 contains a race condition vulnerability in src/server/routes/raw/[id].ts that allows remote attackers to bypass file maxViews limits through non-atomic view counting. Attackers holding a file link can send parallel requests that read the same pre-increment count, viewing view-limited or delete-on-max-views files beyond their limit.

Related CWEs

Time-of-check Time-of-use (TOCTOU) Race Condition

The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.

References (6)

https://github.com/diced/zipline/blob/v4.7.0/src/server/routes/raw/%5Bid%5D.ts#L101-L133

Source: disclosure@vulncheck.com

https://github.com/diced/zipline/commit/1770479d6795ea8700f0ce6ba08a1654d3644c73

Source: disclosure@vulncheck.com

https://github.com/diced/zipline/releases/tag/v4.8.0

Source: disclosure@vulncheck.com

https://github.com/diced/zipline/security/advisories/GHSA-7xv9-wr46-j578

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/zipline-before-4.8.0-maxviews-limit-bypass-via-race-condition

Source: disclosure@vulncheck.com

https://github.com/diced/zipline/security/advisories/GHSA-7xv9-wr46-j578

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.