PT-2026-146782

CVE-2026-126938

Published

2026-11-13

Updated

2026-11-13

Description by

CVSS 3.1

7.1

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Zipline versions prior to 4.6.4

Description An issue exists where authenticated users can bypass chunked-upload size and quota checks by forging Content-Range offsets and totals. By sending small chunks to the partial upload endpoint with large declared offsets, an attacker can force the server to create oversized files, leading to disk space exhaustion.

Recommendations Update to version 4.6.4 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Superintendent2521

Vendors

Affected products

Weakness enumeration

CWE-770: Allocation of Resources Without Limits or Throttling

Related identifiers