PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-26058 zulip CVE debrief

A path traversal vulnerability was discovered in Zulip, an open-source team collaboration tool, affecting versions from 1.4.0 to before 11.6. The vulnerability exists in the ./manage.py import function, which reads arbitrary files from the server filesystem via path traversal in uploads/records.json. A crafted export tarball causes the server to copy any file the zulip user can read into the uploads directory during import. This issue has significant operational impact as it allows attackers to access sensitive files. The CVE record and NVD entry provide the basis for this debrief, but defenders should verify the affected scope and vendor guidance.

Vendor
zulip
Product
Unknown
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-03
Original CVE updated
2026-07-24
Advisory published
2026-04-03
Advisory updated
2026-07-24

Who should care

Users of Zulip versions 1.4.0 to 11.5 should be aware of this vulnerability and take steps to mitigate it by updating to version 11.6 or applying the provided patch. This includes operators, platform administrators, vulnerability management teams, and security teams who need to assess the impact on their deployments and take necessary actions.

Technical summary

The vulnerability is caused by the ./manage.py import function not properly sanitizing file paths, allowing an attacker to traverse the server filesystem and read arbitrary files. This is achieved by manipulating the uploads/records.json file in a crafted export tarball, which can then be used to copy files into the uploads directory during import. The issue affects Zulip versions from 1.4.0 to before 11.6, and it has significant operational impact as it allows attackers to access sensitive files. Users should be cautious and take steps to mitigate this vulnerability.

Defensive priority

Medium-High due to potential for sensitive file exposure and exploitation through crafted export tarballs requiring immediate attention and mitigation through updates or compensating controls for affected Zulip deployments.

Recommended defensive actions

  • Update to Zulip version 11.6 or later
  • Apply the provided patch
  • Restrict access to the ./manage.py import function
  • Monitor for suspicious activity
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-04-03T21:17:10.230Z and last modified on 2026-07-24T22:10:00.140Z. The NVD entry is currently Analyzed. The vulnerability affects Zulip versions from 1.4.0 to before 11.6. Evidence is based on the CVE record and NVD entry, which may have limited information. Defenders should verify affected scope and vendor guidance.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-03T21:17:10.230Z and has not been modified since then. The NVD entry is currently Analyzed.