Path Traversal Vulnerability in Open Zaak Data Layer
CVE-2026-55836
6.8MEDIUM
What is CVE-2026-55836?
A path traversal vulnerability affects the Open Zaak data layer, allowing attackers to exploit an improperly validated CSV field. Versions from 1.13.0 to 1.29.0 permit users with an all-authorizations application token to specify absolute or parent-traversal paths, potentially accessing sensitive files via the Celery service account. This can result in the unintended exposure of server secrets or private data through the document download API. The issue is resolved in versions 1.27.2, 1.28.2, and 1.29.0.
Affected Version(s)
open-zaak >= 1.13.0, < 1.27.2 < 1.13.0, 1.27.2
open-zaak >= 1.28.0, < 1.28.2 < 1.28.0, 1.28.2