CVE-2026-55836 Details
Description
Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, _import_document_row in src/openzaak/components/documenten/tasks.py uses the attacker-controlled bestandspad CSV field without ensuring that the resolved path remains under IMPORT_DOCUMENTEN_BASE_DIR. A client with an all-authorizations application token can supply an absolute or parent-traversal path to a file readable by the Celery service account. The worker copies that file into document storage, allowing its contents to be retrieved through the normal document download API and exposing server secrets or other private files. This issue is fixed in versions 1.27.2, 1.28.2, and 1.29.0.
A path traversal vulnerability has been identified in Open Zaak, an open-source data and services layer for Dutch case-oriented work. The issue affects versions 1.13.0 through 1.27.2, as well as 1.28.2 and 1.29.0. The vulnerability arises in the '_import_document_row' function of the 'tasks.py' file within the 'documenten' component. Here, the 'bestandspad' CSV field is used without proper validation, allowing attackers to specify absolute or parent-traversal paths to files readable by the Celery service account. This could lead to the unauthorized exposure of sensitive files, such as application secrets or other private documents, through the standard document download API.
Users can update to Open Zaak versions 1.27.2, 1.28.2, or 1.29.0, all of which include the necessary fix.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/open-zaak/open-zaak/security/advisories/GHSA-x5cj-23hr-5r54 | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/open-zaak/open-zaak/commit/4b23957b55ab792bc2ba1fbc5ce6918881b62ab8 | [email protected] | Source CodeVendor |
| https://github.com/open-zaak/open-zaak/commit/69c78ce2a0edb45bec8809bc2205585c5f8a4054 | [email protected] | Source CodeVendor |
| https://github.com/open-zaak/open-zaak/commit/8acd5e59e0132aa19284bf22f7b3defca279e2ce | [email protected] | Source CodeVendor |
| https://github.com/open-zaak/open-zaak/releases/tag/1.27.2 | [email protected] | Release NotesVendor |
| https://github.com/open-zaak/open-zaak/releases/tag/1.28.2 | [email protected] | Release NotesVendor |
| https://github.com/open-zaak/open-zaak/releases/tag/1.29.0 | [email protected] | BundleRelease NotesVendor |
| https://github.com/open-zaak/open-zaak/security/advisories/GHSA-x5cj-23hr-5r54 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Open Zaak | >= 1.13.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | New CVE Received | [email protected] |
| Oct 16, 2026 | CVE Modified | CISA-ADP |