Diced vulnerabilities
We track 10 vulnerabilities in Diced products. 10 are rated high or critical, and none are known to be exploited. The most recent was published on November 13, 2026.
Latest Diced vulnerabilities
- 8.1 High severity
zipline: Improper Verification of Cryptographic Signature
Zipline through 4.4.0 contains an authentication bypass vulnerability in the WebAuthn login endpoint that creates sessions for a supplied registered credential ID without verifying the assertion. Attackers who obtain a target's passkey credential ID can impers
- 7.0 High severity
zipline: Improper Limitation of a Pathname to a Restricted Directory
Zipline through 4.4.0 contains a path traversal vulnerability that allows authenticated attackers to delete arbitrary server files by injecting traversal sequences via the x-zipline-file-extension header. Attackers can upload a file with a poisoned stored name
- 7.0 High severity
zipline: Improper Limitation of a Pathname to a Restricted Directory
Zipline through 4.4.0 contains a path traversal vulnerability in the PATCH /api/user/files/:id rename endpoint that allows authenticated users to overwrite existing uploads by supplying unsanitized names. Attackers can submit names like ../uploads/victim.txt t
- 8.8 High severity
zipline: Authorization Bypass Through User-Controlled Key
Zipline before 4.5.0 contains an insecure direct object reference vulnerability caused by missing ownership verification in the PATCH and DELETE handlers for /api/user/folders/:id. Authenticated attackers can supply another user's folder ID to rename it, make
- 8.7 High severity
zipline: Improper Neutralization of Input During Web Page Generation
Zipline before 4.5.1 contains a stored cross-site scripting vulnerability in the HighlightCode component that renders unescaped file content before highlight.js finishes loading. Authenticated attackers can upload text files containing HTML/JavaScript payloads
- 7.1 High severity
zipline: Allocation of Resources Without Limits or Throttling
Zipline before 4.6.4 contains a resource allocation vulnerability that allows authenticated users to bypass chunked-upload size and quota checks by forging Content-Range offsets and totals. Attackers can send tiny chunks to the partial upload endpoint with lar
- 8.1 High severity
zipline: Time-of-check Time-of-use (TOCTOU) Race Condition
Zipline before 4.6.5 contains a TOCTOU race condition in the POST /api/setup endpoint that allows unauthenticated attackers to create multiple SUPERADMIN accounts by racing concurrent requests before the firstSetup flag is reset. Attackers can send simultaneou
- 8.1 High severity
zipline: Improper Limitation of a Pathname to a Restricted Directory
Zipline through 4.3.2 contains a path traversal vulnerability that allows authenticated uploaders to write files outside the upload directory by supplying traversal sequences in the x-zipline-filename header. Attackers using the local datasource can create or
- 8.6 High severity
zipline: Incorrect Authorization
Zipline through 3.7.9 contains an improper authorization vulnerability in the /api/auth/register endpoint, which enforces invite codes only when user registration is disabled, so registration succeeds without an invite when both invites and user registration a
- 7.7 High severity
zipline: Improper Limitation of a Pathname to a Restricted Directory
Zipline versions from 3.4.5 before 3.7.10 contain a path traversal vulnerability in the user data export endpoint via the name query parameter. Authenticated attackers can bypass the user id check and use directory traversal sequences to read arbitrary files o