CVE-2026-55836

Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, _import_document_row in src/openzaak/components/documenten/tasks.py uses the attacker-controlled bestandspad CSV field without ensuring that the resolved path remains under IMPORT_DOCUMENTEN_BASE_DIR. A client with an all-authorizations application token can supply an absolute or parent-traversal path to a file readable by the Celery service account. The worker copies that file into document storage, allowing its contents to be retrieved through the normal document download API and exposing server secrets or other private files. This issue is fixed in versions 1.27.2, 1.28.2, and 1.29.0.

• CWE-200

• https://github.com/open-zaak/open-zaak/commit/4b23957b55ab792bc2ba1fbc5ce6918881b62ab8
• https://github.com/open-zaak/open-zaak/commit/69c78ce2a0edb45bec8809bc2205585c5f8a4054
• https://github.com/open-zaak/open-zaak/commit/8acd5e59e0132aa19284bf22f7b3defca279e2ce
• https://github.com/open-zaak/open-zaak/releases/tag/1.27.2
• https://github.com/open-zaak/open-zaak/releases/tag/1.28.2
• https://github.com/open-zaak/open-zaak/releases/tag/1.29.0
• https://github.com/open-zaak/open-zaak/security/advisories/GHSA-x5cj-23hr-5r54
• https://github.com/open-zaak/open-zaak/security/advisories/GHSA-x5cj-23hr-5r54

Published

Oct 16, 2026

Last Modified

Oct 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55830RestrictedPython is a tool that helps to define a subset of …8.3
• CVE-2026-55831Netty is a network application framework for development of …7.5
• CVE-2026-55832Tract is a tiny, no-nonsense, self-contained TensorFlow and …6.1
• CVE-2026-55833Netty is a network application framework for development of …7.5
• CVE-2026-55834Pocket ID is an OIDC provider that allows users to authentic…4.3
• CVE-2026-55835Lookyloo is a web interface that allows users to capture a w…6.9
• CVE-2026-55837dbt-mcp is a Model Context Protocol server for interacting w…6.8
• CVE-2026-55838RustFS is a distributed object storage system built in Rust.…4.3
• CVE-2026-55839Kestra is an open-source, event-driven orchestration platfor…8.7
• CVE-2026-5584A vulnerability has been found in Fosowl agenticSeek 0.1.0. …9.8
• CVE-2026-55840Scoold is a Q&A and a knowledge sharing platform for teams. …5.4
• CVE-2026-55841Graylog is a free and open log management platform. Prior to…7.5