CVE-2025-71461

Name of the Vulnerable Software and Affected Versions Zipline versions prior to 4.0.2

Description An issue exists where filenames for uploads are predictable. By recovering the state of the Math.random generator, an attacker who obtains five consecutive gfycat-style filenames can reconstruct the random state. This allows the prediction of previous and future filenames until the instance restarts, which may expose private uploads.

Recommendations Update Zipline to version 4.0.2 or later.