Vulnerabilities

TI-2026-21062 CVE-2026-26058

Zulip: Path Traversal in Import

MEDIUM 60

Zulip is an open-source team collaboration tool.

CVSS 3.1MEDIUM 6.1 Local No auth User interaction EPSS 0.00246 Published 2026-04-03 Fixed in 11.6 CWE-22

TI-2026-20810 CVE-2026-25742

Zulip: Anonymous File Access After Disabling Spectator Access

MEDIUM 63

Zulip is an open-source team collaboration tool.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00324 Published 2026-04-03 Fixed in 11.6 CWE-862

TI-2025-30323 CVE-2025-47930

Zulip Server has access control bypass for restrictions on creation of specific channel types

LOW 24

Zulip is an open-source team chat application.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00354 Published 2025-05-15 Fixed in 10.3 CWE-863

TI-2025-21674 CVE-2025-30368

Zulip allows the deletion of organization by administrators of a different organization

LOW 14

Zulip is an open-source team collaboration tool.

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00349 Published 2025-03-31 Fixed in 10.1 CWE-566

TI-2024-24357 CVE-2024-36625 · GHSA-xxvh-8h9p-mpwj

Zulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the replace_emoji_with_text function in ui_util.ts.

LOW 27

Zulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the replace_emoji_with_text function in ui_util.ts.

CVSS 3.1MEDIUM 6.1 Network Low privileges User interaction EPSS 0.00412 Published 2024-11-29 No fix listed CWE-79

TI-2024-24356 CVE-2024-36624 · GHSA-49pw-2xfg-hw49

Zulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the construct_copy_div function in copy_and_paste.js.

LOW 27

Zulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the construct_copy_div function in copy_and_paste.js.

CVSS 3.1MEDIUM 6.1 Network Low privileges User interaction EPSS 0.00412 Published 2024-11-29 No fix listed CWE-79

TI-2023-13143 CVE-2023-28623

Unauthorized user can register an account in specific configurations in Zulip

LOW 29

Zulip is an open-source team collaboration tool with unique topic-based threading.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00527 Published 2023-05-19 Fixed in 6.2 CWE-285

TI-2023-15953 CVE-2023-32677

Users who can send invitations can erroneously add users to streams during invitation in Zulip

MEDIUM 48

Zulip is an open-source team collaboration tool with unique topic-based threading.

CVSS 3.1LOW 3.1 Network Low privileges No interaction EPSS 0.00563 Published 2023-05-19 No fix listed CWE-862

TI-2022-16472 CVE-2022-36048

IP address leak via image proxy bypass in Zulip Server

LOW 21

Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00644 Published 2022-08-31 Fixed in 5.6 CWE-436

TI-2022-16387 CVE-2022-35962

Crafted link in Zulip message can cause disclosure of credentials

LOW 39

Zulip is an open source team chat and Zulip Mobile is an app for iOS and Andriod users.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.01143 Published 2022-08-29 Fixed in 27.190 CWE-184

TI-2016-03803 CVE-2016-4427 · GHSA-58ww-8hxm-f99f

In zulip before 1.3.12, deactivated users could access messages if SSO was enabled.

LOW 34

In zulip before 1.3.12, deactivated users could access messages if SSO was enabled.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00767 Published 2022-07-28 No fix listed CWE-284

TI-2016-03802 CVE-2016-4426 · GHSA-xv4m-3w46-f9wh

In zulip before 1.3.12, bot API keys were accessible to other users in the same realm.

LOW 21

In zulip before 1.3.12, bot API keys were accessible to other users in the same realm.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00551 Published 2022-07-28 No fix listed CWE-284

TI-2022-13210 CVE-2022-31168

Zulip Server insufficient authorization for changing bot roles

MEDIUM 40

Zulip is an open source team chat tool.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00823 Published 2022-07-22 Fixed in 5.5 CWE-285

TI-2022-13062 CVE-2022-31017

Expression Always True vulnerability in Zulip Server

LOW 14

Zulip is an open-source team collaboration tool.

CVSS 3.1LOW 2.6 Network Low privileges User interaction EPSS 0.00583 Published 2022-06-25 Fixed in 5.3 CWE-571

TI-2022-08565 CVE-2022-24751

Race condition in Zulip

LOW 34

Zulip is an open source group chat application.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00955 Published 2022-03-16 Fixed in 4.11 CWE-362

TI-2021-02864 CVE-2021-3967 · GHSA-2xp9-33rm-wcwv

Improper Access Control in zulip/zulip

MEDIUM 40

Improper Access Control in GitHub repository zulip/zulip prior to 4.10.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00838 Published 2022-02-26 Fixed in 4.10 CWE-284

TI-2021-19605 CVE-2021-43799

RabbitMQ exposes ports with weak default secrets in Zulip Server

MEDIUM 56

Zulip is an open-source team collaboration tool.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.05386 Published 2022-01-25 Fixed in 4.9 CWE-338

TI-2021-02796 CVE-2021-3866 · GHSA-c9g2-65fq-w8q5

Cross-site Scripting (XSS) - Stored in zulip/zulip

LOW 26

Cross-site Scripting (XSS) - Stored in GitHub repository zulip/zulip more than and including 44f935695d452cc3fb16845a0c6af710438b153d and prior to 3eb2791c3e9695f7d37ffe84e0c2184fae665cb6.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0089 Published 2022-01-20 Fixed in 3eb2791c3e9695f7d37ffe84e0c2184fae665cb6 CWE-79

TI-2021-19598 CVE-2021-43791

Ineffective expiration validation for invitation links in Zulip

LOW 30

Zulip is an open source group chat application that combines real-time chat with threaded conversations.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00663 Published 2021-12-02 Fixed in 4.8 CWE-613

TI-2021-17954 CVE-2021-41115

Regular expression denial-of-service in Zulip

LOW 32

Zulip is an open source team chat server.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01737 Published 2021-10-07 Fixed in 4.7 CWE-1333

Vulnerabilities

Filters