CVE-2026-26058

Name of the Vulnerable Software and Affected Versions Zulip versions 1.4.0 through 11.5

Description An issue exists where the ./manage.py import command allows the reading of arbitrary files from the server filesystem. This occurs due to path traversal in uploads/records.json, where a specially crafted export tarball can force the server to copy any file accessible by the zulip user into the uploads directory during the import process. Path traversal is a technique used to access files and directories that are stored outside the web root folder.

Recommendations Update to version 11.6.