zipline

File Storage & Sync

A next‑generation self‑hosted file upload and ShareX capture server

Track releases GitHub Website

TypeScript Latest v4.6.2 · 22h ago Security brief →

Features

Quick setup via Docker compose
Supports local, S3, or other remote storage backends
URL shortening, webhooks (Discord/HTTP), OAuth2, 2FA and passkey auth
Image/video processing (compression, thumbnails)
API, PWA interface, custom themes and quota management

Recent releases

View all 9 releases →

Review required

v4.6.2 Security relevant 22h

Auth RCE / SSRF

GHSA fixes

Open

Upgrade now

v4.6.1 Breaking risk 14d

Dependencies

Node.js 24 requirement + fixes

Open

Review required

v4.6.0 New feature 23d

Auth

TOTP tolerance + 2FA auto‑submit

Open

v4.5.3 Mixed 1mo

⚠ Upgrade required

S3 SDK updated and verified compatible with AWS S3, Google Cloud Storage, Backblaze B2, Minio, Rustfs, and Cloudflare R2

Notable features

New settings layout with each server setting on its own page
Instantaneous thumbnail generation
Pagination added to folder view

Full changelog

What's Changed

fixed HTML escaping issues with SSR
fixed other logins divider when none were available
fixed URL shortener allowing reserved routes
fixed performance issues on code highlighter
updated packages, S3 sdk is up-to-date, please open issues if you encounter them
- tested on and working:
  - aws s3
  - google cloud storage
  - backblaze b2
  - minio
  - rustfs
  - cloudflare r2
added new settings layout, every server setting is now separate and on their own page
added instantaneous thumbnail generation (Features > Thumbnails > Instantaneous)
added pagination to folder view

Full Changelog: https://github.com/diced/zipline/compare/v4.5.2...v4.5.3

View release on GitHub

v4.5.2 Bug fix 2mo

Hotfix addressing white blank page on certain configurations, MFA settings display issues, batch upload notifications, and catch-all route rendering problems.

View release on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.