External risk intelligence

Zipline Stored Cross-Site Scripting in HighlightCode Component

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-126945

Zipline is commonly deployed as a self-hosted image and file hosting service that is often internet-facing to allow public access to hosted files. As a web-based application, its interface and file upload functionalities are typically accessible over the network, making the application's components reachable in common deployment patterns.

Cross-site Scripting

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the Zipline software that could allow unauthorized actions if a user views a specially crafted file. This issue stems from how the software handles file content before it's fully processed, potentially enabling attackers to execute malicious code within a user's browser. The main concern is to confirm if our deployed instances of this technology are affected and exposed.

A flaw allows embedded malicious code in files.
It enables attackers to perform actions as a user.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker with authenticated access can upload a crafted text file to the Zipline application. This file, when viewed, will cause unescaped code to execute in the browser of anyone who opens it, potentially allowing the attacker to perform actions on behalf of the victim.

Authenticated access to upload files required.
Stored cross-site scripting in file rendering.
Account takeover and unauthorized actions possible.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect authenticated users by allowing attackers to inject malicious code into uploaded files. When these files are viewed, the code could execute within the viewer's browser, potentially enabling unauthorized actions on their account.

User-uploaded text files.
Viewers accessing crafted files.
Account actions performed on behalf of users.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Zipline deployments, likely managed by application owners or platform teams responsible for code repositories and user-facing services. The immediate priority is to identify all instances of Zipline, assess their exposure and criticality, and locate the accountable system owner. Following this, a remediation plan, potentially involving vendor coordination or temporary mitigations, should be developed based on the assessed risk.

Identify Zipline instances and assess risk.
Confirm system ownership and business criticality.
Plan remediation with vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Zipline?

Zipline is a self-hosted software platform designed for hosting and sharing files and images. Organizations and individuals typically use it as a centralized service to manage and distribute digital assets, often providing web-based access to these files for various users or the public.

What does CVE-2026-126945 mean for security?

This vulnerability is classified as Stored Cross-Site Scripting (CWE-79). It means the application fails to properly clean text file content before displaying it in the browser via the HighlightCode component. Because the system renders this unescaped content before security features are active, malicious scripts injected into files can run automatically when a victim opens the file, allowing the attacker to perform unauthorized actions within the victim's account.

How does an attacker trigger this vulnerability?

To trigger the bug, an attacker must have an account to upload a specially crafted text file containing malicious HTML or JavaScript. Simply having the file stored on the server is not enough; the vulnerability is triggered when a user, such as an administrator or another authenticated person, views that specific malicious file in their browser. Viewing legitimate, non-crafted files does not trigger the exploit.

Is my Zipline instance at risk?

According to Halo Surface Signal, Zipline is often deployed as an internet-facing service to facilitate public file access. If your instance is reachable over the network and allows file uploads, the risk is higher because the interface is accessible. Systems that are restricted to internal networks still face risk if untrusted users have authentication credentials to upload files.

What should I do if I run Zipline?

First, identify all instances of Zipline within your environment and verify which versions are currently in use. Once identified, evaluate the risk based on your deployment's visibility and user access controls. Coordinate with your team to plan for updates to version 4.5.1 or newer, which addresses the flaw, and ensure you have a clear understanding of system ownership to manage the patching process effectively.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.