Executive brief
Zulip is an open-source team collaboration platform. A security flaw in its data import tool allows an attacker to steal sensitive files from the server's filesystem, such as configuration secrets or system passwords. To exploit this, an attacker must trick an administrator into running a malicious data import using a specially crafted file.
Technical details
A path traversal vulnerability (CWE-22) exists in the `./manage.py import` command of Zulip Server. The root cause is a failure to sanitize file paths within the `uploads/records.json` file contained in export tarballs. When an administrator imports a crafted tarball, the `import_uploads` function in `zerver/lib/import_realm.py` uses `os.path.join` on unsanitized input, allowing an attacker to reference files outside the intended directory. This results in the server copying arbitrary files (readable by the 'zulip' user) into the public uploads directory or an S3 bucket. The issue is fixed in version 11.6 by implementing path validation using `os.path.realpath`.
Affected products
- Zulip Zulip Server 1.4.0 to 11.5
Timeline
- 2026-03-31: patched: Fix committed to repository
- 2026-03-31: advisory: GitHub Security Advisory published
- 2026-04-03: disclosed: CVE published to NVD