What is the CVSS score of CVE-2026-26058?

CVE-2026-26058 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-26058?

Yes, a patch is available for CVE-2026-26058. Update the affected software to the latest version immediately.

Zulip CVE-2026-26058

EUVD-2026-18838 MEDIUM

Path Traversal (CWE-22)

2026-04-03 security-advisories@github.com

Path Traversal Zulip

6.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.1 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

11.6

EUVD ID Assigned

Apr 03, 2026 - 21:22 euvd

EUVD-2026-18838

Analysis Generated

Apr 03, 2026 - 21:22 vuln.today

CVE Published

Apr 03, 2026 - 21:17 nvd

MEDIUM 6.1

DescriptionGitHub Advisory

Zulip is an open-source team collaboration tool. From version 1.4.0 to before version 11.6, ./manage.py import reads arbitrary files from the server filesystem via path traversal in uploads/records.json. A crafted export tarball causes the server to copy any file the zulip user can read into the uploads directory during import. This issue has been patched in version 11.6.

AnalysisAI

Path traversal in Zulip's ./manage.py import function allows local attackers to read arbitrary files from the server filesystem and copy them into the uploads directory via a crafted export tarball containing specially crafted paths in uploads/records.json. Zulip versions 1.4.0 through 11.5 are affected; the vulnerability requires local access and user interaction (import initiation) but can expose sensitive server data readable by the Zulip application user. No active exploitation has been confirmed; a vendor-released patch is available in version 11.6.

Technical ContextAI

The vulnerability exploits improper path validation in Zulip's import mechanism, which processes tarball exports containing a records.json file that references file paths. The underlying issue is a classic path traversal flaw (CWE-22) where insufficient sanitization of file paths allows directory traversal sequences (e.g., ../) to escape the intended uploads directory sandbox. When an administrator or authorized user imports a malicious tarball during server migration or restoration, the import process resolves these traversal paths against the actual filesystem, enabling arbitrary file read access. The flaw exists in the Python-based Django management command that handles import logic, affecting all installations from 1.4.0 onward until patching.

RemediationAI

Vendor-released patch: Zulip version 11.6 and later. Upgrade immediately to Zulip 11.6 or the latest available release via the standard Zulip upgrade procedure. If immediate upgrade is not feasible, restrict access to the ./manage.py import command and the tarball import UI to highly trusted administrators only; validate that export tarballs are generated from trusted, authenticated Zulip instances and have not been modified in transit. Refer to the official security advisory at https://github.com/zulip/zulip/security/advisories/GHSA-xm5c-c6mp-3956 for complete patching instructions and verification steps.