Open Zaak EUVD-2026-102900

Exploitation requires: (1) a valid Open Zaak all-authorizations application token (PR:H - a highly privileged credential, the primary limiting factor); (2) the document-import feature in use with IMPORT_DOCUMENTEN_BASE_DIR configured and a reachable import API; and (3) the target file must be readable by the Celery service account. The attacker-controlled bestandspad CSV field must contain an absolute path or parent-traversal (../) sequence that resolves outside the import base directory. Affected versions are 1.13.0 up to (but not including) the fixes in 1.27.2, 1.28.2, and 1.29.0; no user interaction is needed and the attack is scriptable once a token is held. The requirement for a trusted all-authorizations token is the key factor that keeps real-world risk below the raw CVSS network/low-complexity signals.

This is a genuine but constrained path-traversal information-disclosure flaw (CWE-200), not a drop-everything priority. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N = 6.8 Medium) is internally consistent with the description: exploitation is network-reachable and low-complexity, but requires PR:H - specifically an all-authorizations application token, a highly privileged credential - which sharply limits the realistic attacker population to already-trusted integrations or an attacker who has stolen such a token. The scope change (S:C) and C:H are justified because files owned by the Celery service account outside the application's intended data boundary (server secrets, other private files) become retrievable, with no integrity or availability impact. No EPSS score, KEV listing, POC, or SSVC data was provided in the input; per precision rules this means 'no public exploit identified at time of analysis.' There is no signal of active exploitation - absence of EPSS/KEV is not evidence of either direction, but combined with the PR:H barrier and the product's narrow (Dutch government) deployment base, mass exploitation is unlikely. Treat as a prioritized patch for the specific organizations running Open Zaak, especially those exposing the document import API to multiple token holders, rather than an emergency across general infrastructure.

An attacker holding (or having compromised) an Open Zaak all-authorizations application token submits a document-import CSV in which the bestandspad field is an absolute or parent-traversal path (e.g. /etc/openzaak/secrets or ../../etc/passwd) pointing to a file readable by the Celery service account. The worker copies that file into document storage, after which the attacker retrieves its contents through the normal document download API. No public exploit code was identified at time of analysis, but the vulnerable code path is confirmed by the vendor security advisory and the fixing commit.