CVE-2026-55836

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-55836

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55836.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-55836

Aliases

GHSA-x5cj-23hr-5r54

Published

2026-10-16T15:23:22Z

Modified

2026-10-24T02:48:31Z

Severity

6.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N CVSS Calculator

Summary

Open Zaak: Path traversal / arbitrary server-file read via Documenten API document import (bestandspad)

Details

Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, _import_document_row in src/openzaak/components/documenten/tasks.py uses the attacker-controlled bestandspad CSV field without ensuring that the resolved path remains under IMPORT_DOCUMENTEN_BASE_DIR. A client with an all-authorizations application token can supply an absolute or parent-traversal path to a file readable by the Celery service account. The worker copies that file into document storage, allowing its contents to be retrieved through the normal document download API and exposing server secrets or other private files. This issue is fixed in versions 1.27.2, 1.28.2, and 1.29.0.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-200"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55836.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "1.13.0"
                        },
                        {
                            "fixed":  "1.27.2"
                        },
                        {
                            "introduced":  "1.28.0"
                        },
                        {
                            "fixed":  "1.28.2"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StringRangeExpression"
                }
            ]
        },
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "fixed":  "1.27.2"
                        }
                    ],
                    "source":  "DESCRIPTION"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/open-zaak/open-zaak

Affected ranges

Type

GIT

Repo

https://github.com/open-zaak/open-zaak

Events

Introduced

Fixed

4b23957b55ab792bc2ba1fbc5ce6918881b62ab8

Fixed

69c78ce2a0edb45bec8809bc2205585c5f8a4054

Fixed

8acd5e59e0132aa19284bf22f7b3defca279e2ce

Fixed

19d59a923cf9e59d4f424cde42f4d22967b1d9b3

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "fixed":  "4b23957b55ab792bc2ba1fbc5ce6918881b62ab8"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "69c78ce2a0edb45bec8809bc2205585c5f8a4054"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "8acd5e59e0132aa19284bf22f7b3defca279e2ce"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "1.29.0",
            "range":  [
                {
                    "fixed":  "19d59a923cf9e59d4f424cde42f4d22967b1d9b3"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

0.*

0.9.0

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.1.1

1.10.0

1.10.1

1.11.0

1.12.0

1.12.1

1.13.0

1.13.0-archief.0

1.14.0

1.15.0

1.16.0

1.2.0

1.22.0-alpha.0-perftest

1.27.0

1.28.0

1.3.0

1.3.1

1.3.2

1.3.3

1.3.4

1.3.5

1.4.0

1.5.0

1.6.0

1.7.0

1.7.1

1.8.0

1.8.1

1.8.2-performance-fixes

zgw-consumers-1.*

zgw-consumers-1.1.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55836.json"