Skip to content
Zipline Path Traversal Vulnerabilities Affect Multiple Versions

Zipline Path Traversal Vulnerabilities Affect Multiple Versions

First seen 13 Nov 2026, 17:12 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 13, 2026 at 17:13 UTC
  • •Two path traversal vulnerabilities found in Zipline software.
  • •Affected versions include 3.4.5 to 3.7.10 and 4.3.2.
  • •Patches are available; users should update immediately.

Two path traversal vulnerabilities have been identified in Zipline software, affecting versions 3.4.5 through 3.7.10 and 4.3.2. The first vulnerability allows unauthorized access via the user export endpoint, while the second exploits the x-zipline-filename header. Both vulnerabilities are categorized under CWE-22 for improper pathname limitations. No has been reported, but users are advised to update to the latest versions to mitigate potential risks. The vulnerabilities are documented in GitHub Security Advisories GHSA-v38v-92cm-6mx8 and GHSA-4jm6-mgwv-fq63. As of today, patches are available for the affected versions.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 6h ago How this analysis works

Timeline

2026-11-13
Vulnerabilities disclosed
Zipline vulnerabilities affecting multiple versions were publicly disclosed, prompting immediate patching efforts.
VulnCheck
2026-11-13
Patches released
Patches for the identified vulnerabilities were released on the same day as the disclosure, urging users to update.
VulnCheck

More articles in this cluster (2)

Extracted Entities (2)

1 / 3

Common questions

Which versions of Zipline are affected?
Versions 3.4.5 through 3.7.10 and 4.3.2 are affected by the vulnerabilities.
Have these vulnerabilities been exploited in the wild?
No active exploitation has been reported for these vulnerabilities as of now.
What should users do to protect themselves?
Users should update to the latest versions of Zipline to mitigate the vulnerabilities.