Path traversal in Open Zaak lets clients read server files
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.
Summary
Open Zaak versions from 1.13.0 before 1.27.2 and from 1.28.0 before 1.28.2 are affected. The document import does not check that the bestandspad CSV path stays inside the import base directory, a path traversal flaw (CWE-200). A client with an all-authorizations application token can have the import copy any file the Celery service account can read into document storage, then download it through the document download API.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, _import_document_row in src/openzaak/components/documenten/tasks.py uses the attacker-controlled bestandspad CSV field without ensuring that the resolved path remains under IMPORT_DOCUMENTEN_BASE_DIR. A client with an all-authorizations application token can supply an absolute or parent-traversal path to a file readable by the Celery service account. The worker copies that file into document storage, allowing its contents to be retrieved through the normal document download API and exposing server secrets or other private files. This issue is fixed in versions 1.27.2, 1.28.2, and 1.29.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Fixed versions are 1.27.2, 1.28.2 and 1.29.0. Upgrade to one of these fixed versions.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA open-zaak (open-zaak) Fixed in 1.27.2, 1.28.2
Timeline
- 2026-10-16 Threatist record created from CVE-2026-55836
References
Other 7
- https://github.com/open-zaak/open-zaak/security/advisories/GHSA-x5cj-23hr-5r54
- https://github.com/open-zaak/open-zaak/commit/4b23957b55ab792bc2ba1fbc5ce6918881b62ab8
- https://github.com/open-zaak/open-zaak/commit/69c78ce2a0edb45bec8809bc2205585c5f8a4054
- https://github.com/open-zaak/open-zaak/commit/8acd5e59e0132aa19284bf22f7b3defca279e2ce
- https://github.com/open-zaak/open-zaak/releases/tag/1.27.2
- https://github.com/open-zaak/open-zaak/releases/tag/1.28.2
- https://github.com/open-zaak/open-zaak/releases/tag/1.29.0
More open-zaak vulnerabilities
- TI-2026-75346 Open Zaak search endpoints return case metadata beyond token scope CVSS 3.1MEDIUM 6.5
- TI-2020-16072 CORS configuration is possibly vulnerable CVSS 3.1MEDIUM 4.7
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences