CVE-2026-55836

Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, importdocumentrow in src/openzaak/components/documenten/tasks.py uses the attacker-controlled bestandspad CSV field without ensuring that the resolved path remains...

CVE-2026-55836 Open Zaak: Path traversal / arbitrary server-file read via Documenten API document import (bestandspad)

Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, importdocumentrow in src/openzaak/components/documenten/tasks.py uses the attacker-controlled bestandspad CSV field without ensuring that the resolved path remains...

CVE-2026-55836

The Open Zaak data and services layer is vulnerable to path traversal and arbitrary server-file read in versions 1.13.0 through 1.27.2, 1.28.2, and 1.29.0. The root cause lies in the _import_document_row function within src/openzaak/components/documenten/tasks.py, which fails to validate that the...

CVE-2026-55836 Open Zaak: Path traversal / arbitrary server-file read via Documenten API document import (bestandspad)

Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, importdocumentrow in src/openzaak/components/documenten/tasks.py uses the attacker-controlled bestandspad CSV field without ensuring that the resolved path remains...

CVE-2026-55836 Open Zaak: Path traversal / arbitrary server-file read via Documenten API document import (bestandspad)

Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, importdocumentrow in src/openzaak/components/documenten/tasks.py uses the attacker-controlled bestandspad CSV field without ensuring that the resolved path remains...

EUVD-2026-102900

Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, importdocumentrow in src/openzaak/components/documenten/tasks.py uses the attacker-controlled bestandspad CSV field without ensuring that the resolved path remains...

CVE-2026-55836

Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, importdocumentrow in src/openzaak/components/documenten/tasks.py uses the attacker-controlled bestandspad CSV field without ensuring that the resolved path remains...

PT-2026-115629

Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, import document row in src/openzaak/components/documenten/tasks.py uses the attacker-controlled bestandspad CSV field without ensuring that the resolved path remains...

CVE-2026-55836: Exposure of Sensitive Information to an Unauthorized Actor

Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, importdocumentrow in src/openzaak/components/documenten/tasks.py uses the attacker-controlled bestandspad CSV field without ensuring that the resolved path remains...

Open Zaak Information Leak Vulnerability

Versions of Open Zaak 1.13.0 to 1.27.2 and 1.28.0 to 1.28.2 have a vulnerability related to information leakage. This vulnerability arises from the lack of validation for path handling when importing document rows in the importdocumentrow function, specifically in the bestandspad CSV field. The...