CVE-2026-26058 Zulip: Path Traversal in Import

Zulip is an open-source team collaboration tool. From version 1.4.0 to before version 11.6, ./manage.py import reads arbitrary files from the server filesystem via path traversal in uploads/records.json. A crafted export tarball causes the server to copy any file the zulip user can read into the...

PT-2026-30233

Name of the Vulnerable Software and Affected Versions Zulip versions 1.4.0 through 11.5 Description An issue exists where the ./manage.py import command allows the reading of arbitrary files from the server filesystem. This occurs due to path traversal in uploads/records.json, where a specially...