CVE-2026-55836 in Open Zaak
Summary
by MITRE • 10/16/2026
Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, _import_document_row in src/openzaak/components/documenten/tasks.py uses the attacker-controlled bestandspad CSV field without ensuring that the resolved path remains under IMPORT_DOCUMENTEN_BASE_DIR. A client with an all-authorizations application token can supply an absolute or parent-traversal path to a file readable by the Celery service account. The worker copies that file into document storage, allowing its contents to be retrieved through the normal document download API and exposing server secrets or other private files. This issue is fixed in versions 1.27.2, 1.28.2, and 1.29.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified within Open Zaak represents a critical path traversal flaw located in the document import functionality of the application's backend services. Specifically, the issue resides in the _import_document_row function found in src/openzaak/components/documenten/tasks.py. This component is responsible for processing CSV files that contain metadata and file paths for bulk document imports into the system. The core technical failure occurs when the application accepts a user-supplied value from the bestandspad field without performing adequate validation to ensure that the resolved absolute path remains strictly within the designated IMPORT_DOCUMENTEN_BASE_DIR directory. By failing to canonicalize or sanitize this input, the software allows an attacker to manipulate file paths using standard traversal sequences such as ../ or by specifying absolute paths outside the intended sandboxed area. This lack of strict boundary enforcement is a classic example of insecure direct object references combined with path manipulation vulnerabilities, which are frequently categorized under CWE-22: Improper Limitation of a Pathname to a Restricted Directory in industry standards like the Common Weakness Enumeration framework.
From an operational perspective, this vulnerability allows for significant unauthorized data access and potential information disclosure. An attacker who possesses a valid application token with all-authorizations privileges can exploit this flaw by crafting a malicious CSV file that references sensitive files on the server's filesystem. Since the Celery worker process typically runs under a specific service account with permissions to read various system directories, it is able to successfully copy these external files into the document storage area managed by Open Zaak. Once copied, these files become accessible through the standard document download API endpoints that are designed for legitimate users. This effectively bypasses access controls intended to restrict sensitive data, allowing the attacker to retrieve server secrets, configuration files containing credentials, or other private information stored on the host system. The impact is severe as it transforms a routine administrative function into an arbitrary file read vector, potentially leading to full system compromise if critical security artifacts are exposed.
The exploitation of this vulnerability relies heavily on the privilege level associated with the application token used by the client. While the requirement for all-authorizations limits the pool of potential attackers to those who have already gained significant access within the application, it does not mitigate the severity of the resulting data exfiltration. The attack aligns with ATT&CK techniques related to Data from Local System Retrieval and potentially T1083: File and Directory Discovery, as the attacker uses the application's own mechanisms to enumerate and extract sensitive files that are otherwise inaccessible through normal API interactions. This behavior demonstrates how backend logic flaws can be leveraged to escalate access beyond what is intended by the frontend authorization model, highlighting a disconnect between identity management and resource-level security controls.
To mitigate this vulnerability, organizations running Open Zaak must immediately upgrade to patched versions of the software. The issue has been resolved in versions 1.27.2, 1.28.2, and 1.29.0, which implement proper validation logic to ensure that any file path provided during document import is strictly confined within the IMPORT_DOCUMENTEN_BASE_DIR. Administrators should verify their current version and apply these updates as soon as possible. In addition to upgrading, it is advisable to review access control policies for application tokens with broad permissions, ensuring they are issued only to trusted services or users who absolutely require such privileges. Implementing strict input validation on all file path parameters in bulk import operations is a critical security practice that prevents similar traversal attacks across various software ecosystems.