{"id":"CVE-2025-71461","aliases":[],"cve":{"records":[{"id":"CVE-2025-71461","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-11T22:59:05.981Z","published":"2026-11-13T09:37:01.263Z","modified":"2026-11-13T09:37:01.263Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-11-13T09:37:01.263Z"}],"references":[{"url":"https://github.com/diced/zipline/security/advisories/GHSA-6rg9-q9ww-w2rw","tags":["vendor-advisory"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/zipline-before-4.0.2-predictable-filenames-via-math-random-state-recovery","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-338","description":"Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)","source":"VulnCheck"}],"applicability":[],"prioritization":[]},"title":"Zipline before 4.0.2 Predictable Filenames via Math.random State Recovery","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"Zipline before 4.0.2 contains a predictable filename vulnerability that allows attackers to infer other users' upload filenames by recovering the Math.random generator state. Attackers with five consecutive gfycat-style filenames can reconstruct the random state to predict previous and future filenames until the instance restarts, exposing private uploads.","score":6.9,"severity":"medium","published":"2026-11-13T09:37:01.263Z","modified":"2026-11-13T09:37:01.263Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"diced","name":"zipline","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2025-71461"}],"remediation":[],"references":["https://github.com/diced/zipline/security/advisories/GHSA-6rg9-q9ww-w2rw","https://www.vulncheck.com/advisories/zipline-before-4.0.2-predictable-filenames-via-math-random-state-recovery"],"sources":[{"name":"CVE","id":"CVE-2025-71461","modified":"2026-11-13T09:37:01.263Z","url":"https://www.cve.org/CVERecord?id=CVE-2025-71461"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","score":6.9},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3}],"sourceAffected":[],"observedAt":"2026-11-13T12:56:40.962Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T23:40:32.333Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-13T13:15:35.403Z","attemptedAt":"2026-11-13T13:15:35.403Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-13T13:15:34.697Z","attemptedAt":"2026-11-13T13:15:34.697Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-13T13:15:34.799Z","attemptedAt":"2026-11-13T13:15:34.799Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-13T13:15:34.095Z","attemptedAt":"2026-11-13T13:15:34.095Z"}],"evidence":[{"source":"GitHub Advisory Database","id":"GHSA-vf9w-pwwq-jwvx","url":"https://github.com/advisories/GHSA-vf9w-pwwq-jwvx","modified":"2026-11-13T12:31:17Z","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","checkedAt":"2026-11-13T13:15:34.697Z"},{"source":"ENISA EUVD","id":"EUVD-2025-211320","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-211320","modified":"Nov 13, 2026, 12:31:12 PM","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","checkedAt":"2026-11-13T13:15:34.799Z"},{"source":"NVD","id":"CVE-2025-71461","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71461","modified":"2026-11-13T10:17:24.100","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-13T13:15:35.403Z"},{"source":"NVD","id":"CVE-2025-71461","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71461","modified":"2026-11-13T10:17:24.100","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","checkedAt":"2026-11-13T13:15:35.403Z"}],"aiSummary":{"text":"Zipline before 4.0.2 has a predictable filename vulnerability, allowing attackers with access to five consecutive filenames to recover the Math.random generator state and predict previous and future filenames. This exposes private uploads until the instance restarts. Attackers need access to specific filenames to exploit this weakness.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-13T13:01:44.244Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2025-71461"}]}}