Medium severity6.1NVD Advisory· Published Apr 3, 2026· Updated Apr 22, 2026
CVE-2026-26058
CVE-2026-26058
Description
Zulip is an open-source team collaboration tool. From version 1.4.0 to before version 11.6, ./manage.py import reads arbitrary files from the server filesystem via path traversal in uploads/records.json. A crafted export tarball causes the server to copy any file the zulip user can read into the uploads directory during import. This issue has been patched in version 11.6.
Affected products
1Patches
12df49e7750cehttps://github.com/zulip/zulipvia nvd-ref
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
2- github.com/zulip/zulip/commit/2df49e7750ce3fc49ef1d44b1c4ece654d4b754cnvdPatch
- github.com/zulip/zulip/security/advisories/GHSA-xm5c-c6mp-3956nvdExploitVendor Advisory
News mentions
0No linked articles in our index yet.