CVE-2026-126939
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Nov 13, 2026
Vendor
unknown
Description
Zipline before 4.6.4 contains an information disclosure vulnerability in GET /api/server/folder/:id that allows unauthenticated attackers to list files in non-public upload-only folders. Attackers who know the folder UUID can supply the page query parameter to bypass the metadata-only early return and enumerate file names, IDs, MIME types, sizes, and view counts.