Read the docs
TI-2026-21062 Aliases CVE-2026-26058

Zulip: Path Traversal in Import

Priority MEDIUM 60CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Zulip is an open-source team collaboration tool. From version 1.4.0 to before version 11.6, ./manage.py import reads arbitrary files from the server filesystem via path traversal in uploads/records.json. A crafted export tarball causes the server to copy any file the zulip user can read into the uploads directory during import. This issue has been patched in version 11.6.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00246 15th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed zulip (zulip): 11.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
zulipzulip1.4.0 to before 11.611.6Patch availableCNA
  • zulip Vendorzulip Affected 1.4.0 to before 11.6 Fixed in 11.6 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:zulip:zulip:*:*:*:*:*:*:*:*1.4.0 – 11.5Vulnerablezulip
  • cpe:2.3:a:zulip:zulip:*:*:*:*:*:*:*:* Versions 1.4.0 – 11.5 Vulnerable ·zulip

Remediation

  • Fix · CNA zulip (zulip) Fixed in 11.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-26058

References

Exploit 1

Patch 1

  • TI-2026-20810 Zulip: Anonymous File Access After Disabling Spectator Access CVSS 3.1MEDIUM 5.3
  • TI-2021-19605 RabbitMQ exposes ports with weak default secrets in Zulip Server CVSS 3.1CRITICAL 9.8
  • TI-2023-15953 Users who can send invitations can erroneously add users to streams during invitation in Zulip CVSS 3.1LOW 3.1
  • TI-2022-13210 Zulip Server insufficient authorization for changing bot roles CVSS 3.1HIGH 8.8
  • TI-2021-02864 Improper Access Control in zulip/zulip CVSS 3.1HIGH 8.8
  • TI-2022-16387 Crafted link in Zulip message can cause disclosure of credentials CVSS 3.1HIGH 8.0
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences