CVE-2026-26058: Zulip Path Traversal Vulnerability

CVE-2026-26058 Overview

CVE-2026-26058 is a path traversal vulnerability affecting Zulip, an open-source team collaboration tool. The vulnerability exists in the ./manage.py import command, which reads arbitrary files from the server filesystem via path traversal sequences in the uploads/records.json file. When processing a crafted export tarball, the server copies any file readable by the zulip user into the uploads directory during the import process.

Critical Impact

Attackers can craft malicious export tarballs to exfiltrate sensitive server files, potentially exposing configuration files, credentials, and other confidential data accessible to the zulip service account.

Affected Products

• Zulip versions 1.4.0 through 11.5.x
• Zulip Server installations using the import functionality
• Self-hosted Zulip deployments processing untrusted export archives

Discovery Timeline

• 2026-04-03 - CVE-2026-26058 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-26058

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Path Traversal). The root issue lies in the Zulip import functionality's handling of file paths specified in the uploads/records.json manifest file within export tarballs. When importing data, the application fails to properly validate and sanitize file paths, allowing directory traversal sequences such as ../ to escape the intended directory structure.

The attack requires local access to submit a crafted export tarball and user interaction to trigger the import process. Upon successful exploitation, an attacker can achieve high confidentiality impact by accessing sensitive files, with limited integrity impact through file manipulation in the uploads directory. The vulnerability does not directly impact system availability.

Root Cause

The vulnerability stems from insufficient input validation in the file path handling logic within the import functionality. The uploads/records.json file, which contains references to uploaded files that should be restored during import, does not properly sanitize path components. This allows path traversal sequences to be interpreted literally, enabling access to files outside the intended upload directory.

Attack Vector

An attacker must craft a malicious export tarball containing a specially modified uploads/records.json file. This manifest file would include path traversal sequences (e.g., ../../etc/passwd or similar paths) pointing to sensitive server files. When an administrator or privileged user executes the import command on this tarball, the server follows these traversal paths and copies the targeted files into the uploads directory, making them accessible to the attacker.

The attack requires local access to provide the malicious tarball and depends on user interaction to trigger the import operation. Sensitive targets could include configuration files containing database credentials, API keys, TLS private keys, or other secrets accessible to the zulip service account.

Detection Methods for CVE-2026-26058

Indicators of Compromise

• Unusual file access patterns by the zulip user to sensitive system directories
• Unexpected files appearing in the Zulip uploads directory, particularly configuration files or system files
• Import operations processing export archives from untrusted sources
• Log entries showing file operations accessing paths outside the expected import directories

Detection Strategies

• Monitor file system access by the zulip service account for reads outside typical application directories
• Review import operation logs for path traversal patterns such as ../ sequences
• Implement file integrity monitoring on the uploads directory to detect anomalous files
• Alert on import operations that reference files in system directories like /etc/, /var/, or similar

Monitoring Recommendations

• Enable enhanced logging for the ./manage.py import functionality
• Implement audit logging for all file operations performed during import
• Monitor for exports originating from or tarballs provided by untrusted sources
• Establish baseline behavior for import operations to detect anomalies

How to Mitigate CVE-2026-26058

Immediate Actions Required

• Upgrade to Zulip version 11.6 or later immediately
• Audit recent import operations for suspicious activity or unexpected files in uploads
• Restrict access to the import functionality to trusted administrators only
• Review the uploads directory for any unexpected or suspicious files
• Verify the source of any export tarballs before processing

Patch Information

The vulnerability has been patched in Zulip version 11.6. The fix addresses the path traversal issue by implementing proper validation and sanitization of file paths in the uploads/records.json processing logic. For detailed patch information, refer to the GitHub Commit Update and the GitHub Security Advisory.

Workarounds

• Only process export tarballs from trusted and verified sources
• Manually inspect uploads/records.json files for path traversal sequences before import
• Run the zulip service with minimal file system permissions where possible
• Implement network segmentation to limit access to sensitive files if the service is compromised