Zipline

产品介绍

Zipline 是自托管的文件分享和 URL 缩短平台，提供用户管理、文件上传、分享链接、缩略图及管理界面。

主要功能

文件上传、分享、缩略图和到期策略
URL 缩短、访问统计和用户管理
本地数据源、自定义主题和管理界面

访问说明

安装后通过 http://<服务器 IP>:<端口> 访问。默认只绑定 127.0.0.1；如需远程访问，建议通过 HTTPS 反向代理发布。首次打开时创建的第一个账户将成为管理员。

数据持久化

APP_DATA_DIR 中的 postgres、uploads、public 和 themes 分别保存数据库、上传文件、公开资源和自定义主题。升级时保持现有 APP_DATA_DIR 不变。1Panel 卸载应用时会删除应用安装目录，因此位于该目录内的相对数据目录也会被删除；卸载前请先将数据备份到应用目录之外。

从 4.6.5 升级到 4.8.0 时，先升级到 4.7.0 并等待应用完成数据库迁移、恢复健康后，再升级到 4.8.0。升级前请备份 PostgreSQL 数据；升级期间保留现有 APP_DATA_DIR 和数据库身份配置。

安全与部署风险

Zipline 以 UID/GID 1000:1000 运行，数据库以 70:70 运行；两者均丢弃全部 Linux capabilities、使用只读根文件系统并启用 no-new-privileges。PostgreSQL 仅接入内部网络，不发布宿主端口。
固定版本 4.6.5 使用的镜像快照在双架构扫描中仍包含上游漏洞。两份 Critical CVE-2026-59873 仅位于 npm/corepack 工具链，默认服务入口不调用这些工具。
@fastify/static 9.1.3 受 CVE-2026-15074 影响，但该公告仅允许绕过受保护 URL 前缀并读取同一静态根中的文件，不能越出静态根。Zipline 的 build/client 根本来就是公开前端资源；临时目录以 serve:false 注册，用户导出通过固定文件名和认证中间件发送。该默认路径例外不代表漏洞不存在。
其余 High 位于构建工具、Prisma 迁移配置、静态 schema/路由依赖或需要 Zipline 默认监听器未启用的 HTTP/2/RSC 等功能。不要在容器内运行 npm/pnpm、载入不可信 Prisma 配置或改变官方入口；移动 latest 标签解析到新镜像后必须重新扫描。

Introduction

Zipline is a self-hosted file sharing and URL shortening platform with user management, uploads, share links, thumbnails, and an administration interface.

Features

File uploads, sharing, thumbnails, and expiration policies
URL shortening, access statistics, and user management
Local storage, custom themes, and an administration interface

Usage Notes

Access the service at http://<server-ip>:<port>. It binds to 127.0.0.1 by default; publish it through an HTTPS reverse proxy for remote access. The first account created becomes the administrator.
APP_DATA_DIR contains PostgreSQL data, uploads, public assets, and custom themes. Keep its existing value during upgrades. 1Panel removes the app installation directory during uninstall, including relative data directories beneath it; back up the data outside the app directory before uninstalling.
To upgrade an existing 4.6.5 installation to 4.8.0, upgrade to 4.7.0 first and wait for its database migrations and health check to finish. Back up PostgreSQL before upgrading, and keep the existing APP_DATA_DIR and database identity settings.
Zipline runs as UID/GID 1000:1000; PostgreSQL runs as 70:70 on an internal-only network. Both containers drop all capabilities, use read-only root filesystems, and enable no-new-privileges.

Security Note

The prior audit applies to the official 4.6.5 image snapshot only. It found two Critical CVE-2026-59873 findings confined to npm/corepack tooling that the default service entrypoint does not invoke. CVE-2026-15074 in @fastify/static 9.1.3 bypasses route-scoped guards but cannot escape a configured static root; Zipline exposes build/client as intentionally public, registers its temporary root with serve:false, and sends authenticated exports by a fixed server-selected filename. Other High findings are confined to build tooling, Prisma migration configuration, static schema/router dependencies, or features such as HTTP/2 and RSC that the default service does not enable. These are default-path reachability exceptions, not claims that the packages are absent from later images. The 4.7.0 and 4.8.0 image CVEs have not been assessed in this maintenance run.

References

Project: https://github.com/diced/zipline
Docker guide: https://zipline.diced.sh/docs/get-started/docker
Official Compose: https://github.com/diced/zipline/blob/v4.6.5/docker-compose.yml
License: https://github.com/diced/zipline/blob/v4.6.5/LICENSE (MIT)
Static advisory: https://github.com/fastify/fastify-static/security/advisories/GHSA-83w8-p2f5-377r