CVE-2026-126949
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Nov 13, 2026
Vendor
unknown
Description
Zipline through 4.4.0 contains a path traversal vulnerability in the PATCH /api/user/files/:id rename endpoint that allows authenticated users to overwrite existing uploads by supplying unsanitized names. Attackers can submit names like ../uploads/victim.txt that bypass the raw-string database uniqueness check but normalize via path.join(), causing fs.rename() to replace other files' contents.