# CVE-2026-126932: Zipline policy bypass in file metadata MIME type

Source: https://junglewise.ai/threats/cve-2026-126932-zipline-4-6-2-before-4-8-0-contains-a-policy-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-126932 · Severity: medium · CVSS 4.3 · Published 2026-11-11

Zipline is a file-sharing application that allows administrators to restrict which file types users can upload. A vulnerability in versions 4.6.2 through 4.8.0 allows authenticated users to bypass these restrictions by editing a file's metadata after upload, changing its MIME type to a disabled type like text/html. This could enable attackers to serve malicious content (such as JavaScript) that browsers execute, leading to account compromise or malware distribution.

Technologies: [Diced Zipline](https://junglewise.ai/threats/technologies/zipline). Vendors: [Diced](https://junglewise.ai/threats/vendors/diced).

## Quick answers

**Is CVE-2026-126932 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126932 being exploited in the wild.

**How severe is CVE-2026-126932?** Medium severity, with a CVSS score of 4.3, published 11 November 2026.

**Which products and versions are affected?** Diced Zipline 4.6.2 to 4.8.0.

**Is there a fix for CVE-2026-126932?** Yes: fixed in 4.8.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126932 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-126932?** Check whether you run Diced Zipline at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.8.0

## Technical details

The PATCH /api/user/files/:id endpoint accepts a user-supplied "type" parameter and updates the file's MIME type without validating it against the administrator's disabled MIME type policy. An authenticated attacker uploads a permitted file, then uses PATCH to change its type to a disabled value like text/html; when the file is served via /raw/:id, the browser renders it with the spoofed Content-Type. The fix (commit fc8e886) adds enforceMimetypePolicy() validation to the type field during metadata updates.

## Affected products

- diced Zipline 4.6.2 to 4.8.0

## Timeline

- 2026-11-11: disclosed

## References

- [https://github.com/diced/zipline/blob/v4.7.0/src/server/routes/api/user/files/%5Bid%5D/index.ts](https://github.com/diced/zipline/blob/v4.7.0/src/server/routes/api/user/files/%5Bid%5D/index.ts)
- [https://github.com/diced/zipline/commit/fc8e886ca841b86a3f677cd7dac1bf9a5bd45b2c](https://github.com/diced/zipline/commit/fc8e886ca841b86a3f677cd7dac1bf9a5bd45b2c)

## Related threats

- [Zipline rate limit bypass via X-Forwarded-For spoofing](https://junglewise.ai/threats/cve-2026-126934-zipline-4-3-2-before-4-8-0-contains-a-rate-limit-bypass)
- [Zipline upload filter bypass via extension format mismatch](https://junglewise.ai/threats/cve-2026-126933-zipline-4-0-0-before-4-8-0-contains-an-upload-filter-bypass)