Refine your search
3 vulnerabilities found for by open-zaak
CVE-2026-55836 (GCVE-0-2026-55836)
Vulnerability from cvelistv5
Published
2026-10-16 15:23
Modified
2026-10-16 16:01
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Summary
Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, _import_document_row in src/openzaak/components/documenten/tasks.py uses the attacker-controlled bestandspad CSV field without ensuring that the resolved path remains under IMPORT_DOCUMENTEN_BASE_DIR. A client with an all-authorizations application token can supply an absolute or parent-traversal path to a file readable by the Celery service account. The worker copies that file into document storage, allowing its contents to be retrieved through the normal document download API and exposing server secrets or other private files. This issue is fixed in versions 1.27.2, 1.28.2, and 1.29.0.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55836",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T16:01:07.670750Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T16:01:37.738Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/open-zaak/open-zaak/security/advisories/GHSA-x5cj-23hr-5r54"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "open-zaak",
"vendor": "open-zaak",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.13.0, \u003c 1.27.2"
},
{
"status": "affected",
"version": "\u003e= 1.28.0, \u003c 1.28.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, _import_document_row in src/openzaak/components/documenten/tasks.py uses the attacker-controlled bestandspad CSV field without ensuring that the resolved path remains under IMPORT_DOCUMENTEN_BASE_DIR. A client with an all-authorizations application token can supply an absolute or parent-traversal path to a file readable by the Celery service account. The worker copies that file into document storage, allowing its contents to be retrieved through the normal document download API and exposing server secrets or other private files. This issue is fixed in versions 1.27.2, 1.28.2, and 1.29.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T15:23:22.783Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/open-zaak/open-zaak/security/advisories/GHSA-x5cj-23hr-5r54",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/open-zaak/open-zaak/security/advisories/GHSA-x5cj-23hr-5r54"
},
{
"name": "https://github.com/open-zaak/open-zaak/commit/4b23957b55ab792bc2ba1fbc5ce6918881b62ab8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/open-zaak/open-zaak/commit/4b23957b55ab792bc2ba1fbc5ce6918881b62ab8"
},
{
"name": "https://github.com/open-zaak/open-zaak/commit/69c78ce2a0edb45bec8809bc2205585c5f8a4054",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/open-zaak/open-zaak/commit/69c78ce2a0edb45bec8809bc2205585c5f8a4054"
},
{
"name": "https://github.com/open-zaak/open-zaak/commit/8acd5e59e0132aa19284bf22f7b3defca279e2ce",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/open-zaak/open-zaak/commit/8acd5e59e0132aa19284bf22f7b3defca279e2ce"
},
{
"name": "https://github.com/open-zaak/open-zaak/releases/tag/1.27.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/open-zaak/open-zaak/releases/tag/1.27.2"
},
{
"name": "https://github.com/open-zaak/open-zaak/releases/tag/1.28.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/open-zaak/open-zaak/releases/tag/1.28.2"
},
{
"name": "https://github.com/open-zaak/open-zaak/releases/tag/1.29.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/open-zaak/open-zaak/releases/tag/1.29.0"
}
],
"source": {
"advisory": "GHSA-x5cj-23hr-5r54",
"discovery": "UNKNOWN"
},
"title": "Open Zaak: Path traversal / arbitrary server-file read via Documenten API document import (bestandspad)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55836",
"datePublished": "2026-10-16T15:23:22.783Z",
"dateReserved": "2026-06-17T16:29:38.865Z",
"dateUpdated": "2026-10-16T16:01:37.738Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54657 (GCVE-0-2026-54657)
Vulnerability from cvelistv5
Published
2026-10-16 15:21
Modified
2026-10-16 17:06
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST search endpoints /zaken/api/v1/zaken/_zoek and /documenten/api/v1/enkelvoudiginformatieobjecten/_zoek do not filter result querysets according to the authorizations associated with the request token. A caller with a valid zaken.lezen or documenten.lezen token can therefore retrieve case or document metadata outside the token's authorized types or confidentiality levels. Document searches require known UUIDs, and document content remains protected by separate download authorization. This issue is fixed in versions 1.27.2, 1.28.2, and 1.29.0.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54657",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T16:32:04.577772Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:06:31.247Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "open-zaak",
"vendor": "open-zaak",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.0.0, \u003c 1.27.2"
},
{
"status": "affected",
"version": "\u003e= 1.28.0, \u003c 1.28.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST search endpoints /zaken/api/v1/zaken/_zoek and /documenten/api/v1/enkelvoudiginformatieobjecten/_zoek do not filter result querysets according to the authorizations associated with the request token. A caller with a valid zaken.lezen or documenten.lezen token can therefore retrieve case or document metadata outside the token\u0027s authorized types or confidentiality levels. Document searches require known UUIDs, and document content remains protected by separate download authorization. This issue is fixed in versions 1.27.2, 1.28.2, and 1.29.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285: Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T15:21:57.401Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/open-zaak/open-zaak/security/advisories/GHSA-f29q-7rpr-jmjx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/open-zaak/open-zaak/security/advisories/GHSA-f29q-7rpr-jmjx"
},
{
"name": "https://github.com/open-zaak/open-zaak/commit/15456f1a0ef4b0abf1b1c0e3a16c99c15423b9fd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/open-zaak/open-zaak/commit/15456f1a0ef4b0abf1b1c0e3a16c99c15423b9fd"
},
{
"name": "https://github.com/open-zaak/open-zaak/commit/4b429d3243d1532f6fe731f932a201cf0ddc4c18",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/open-zaak/open-zaak/commit/4b429d3243d1532f6fe731f932a201cf0ddc4c18"
},
{
"name": "https://github.com/open-zaak/open-zaak/commit/d3869af98c60570782f867bab3e1d14fd8d8330f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/open-zaak/open-zaak/commit/d3869af98c60570782f867bab3e1d14fd8d8330f"
},
{
"name": "https://github.com/open-zaak/open-zaak/releases/tag/1.27.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/open-zaak/open-zaak/releases/tag/1.27.2"
},
{
"name": "https://github.com/open-zaak/open-zaak/releases/tag/1.28.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/open-zaak/open-zaak/releases/tag/1.28.2"
},
{
"name": "https://github.com/open-zaak/open-zaak/releases/tag/1.29.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/open-zaak/open-zaak/releases/tag/1.29.0"
}
],
"source": {
"advisory": "GHSA-f29q-7rpr-jmjx",
"discovery": "UNKNOWN"
},
"title": "Open Zaak: /zaken/_zoek and /enkelvoudiginformatieobjecten/_zoek endpoints do not filter result lists based on authorizations linked to token"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54657",
"datePublished": "2026-10-16T15:21:57.401Z",
"dateReserved": "2026-06-15T20:16:46.199Z",
"dateUpdated": "2026-10-16T17:06:31.247Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2020-26251 (GCVE-0-2020-26251)
Vulnerability from cvelistv5
Published
2020-12-18 17:20
Modified
2024-08-04 15:56
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-346 - Origin Validation Error
Summary
Open Zaak is a modern, open-source data- and services-layer to enable zaakgericht werken, a Dutch approach to case management. In Open Zaak before version 1.3.3 the Cross-Origin-Resource-Sharing policy in Open Zaak is currently wide open - every client is allowed. This allows evil.com to run scripts that perform AJAX calls to known Open Zaak installations, and the browser will not block these. This was intended to only apply to development machines running on localhost/127.0.0.1. Open Zaak 1.3.3 disables CORS by default, while it can be opted-in through environment variables. The vulnerability does not actually seem exploitable because: a) The session cookie has a `Same-Site: Lax` policy which prevents it from being sent along in Cross-Origin requests. b) All pages that give access to (production) data are login-protected c) `Access-Control-Allow-Credentials` is set to `false` d) CSRF checks probably block the remote origin, since they're not explicitly added to the trusted allowlist.
References
| URL | Tags | |
|---|---|---|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:56:03.634Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/open-zaak/open-zaak/security/advisories/GHSA-chhr-gxrg-64x7"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/open-zaak/open-zaak/commit/952269269f1b629fce9c94485f83ac13f31d6c46"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/open-zaak/open-zaak/blob/master/CHANGELOG.rst#133-2020-12-17"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "open-zaak",
"vendor": "open-zaak",
"versions": [
{
"status": "affected",
"version": "\u003c 1.3.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Open Zaak is a modern, open-source data- and services-layer to enable zaakgericht werken, a Dutch approach to case management. In Open Zaak before version 1.3.3 the Cross-Origin-Resource-Sharing policy in Open Zaak is currently wide open - every client is allowed. This allows evil.com to run scripts that perform AJAX calls to known Open Zaak installations, and the browser will not block these. This was intended to only apply to development machines running on localhost/127.0.0.1. Open Zaak 1.3.3 disables CORS by default, while it can be opted-in through environment variables. The vulnerability does not actually seem exploitable because: a) The session cookie has a `Same-Site: Lax` policy which prevents it from being sent along in Cross-Origin requests. b) All pages that give access to (production) data are login-protected c) `Access-Control-Allow-Credentials` is set to `false` d) CSRF checks probably block the remote origin, since they\u0027re not explicitly added to the trusted allowlist."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346 Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-18T17:20:13.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/open-zaak/open-zaak/security/advisories/GHSA-chhr-gxrg-64x7"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/open-zaak/open-zaak/commit/952269269f1b629fce9c94485f83ac13f31d6c46"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/open-zaak/open-zaak/blob/master/CHANGELOG.rst#133-2020-12-17"
}
],
"source": {
"advisory": "GHSA-chhr-gxrg-64x7",
"discovery": "UNKNOWN"
},
"title": "CORS configuration is possibly vulnerable",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2020-26251",
"STATE": "PUBLIC",
"TITLE": "CORS configuration is possibly vulnerable"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "open-zaak",
"version": {
"version_data": [
{
"version_value": "\u003c 1.3.3"
}
]
}
}
]
},
"vendor_name": "open-zaak"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Open Zaak is a modern, open-source data- and services-layer to enable zaakgericht werken, a Dutch approach to case management. In Open Zaak before version 1.3.3 the Cross-Origin-Resource-Sharing policy in Open Zaak is currently wide open - every client is allowed. This allows evil.com to run scripts that perform AJAX calls to known Open Zaak installations, and the browser will not block these. This was intended to only apply to development machines running on localhost/127.0.0.1. Open Zaak 1.3.3 disables CORS by default, while it can be opted-in through environment variables. The vulnerability does not actually seem exploitable because: a) The session cookie has a `Same-Site: Lax` policy which prevents it from being sent along in Cross-Origin requests. b) All pages that give access to (production) data are login-protected c) `Access-Control-Allow-Credentials` is set to `false` d) CSRF checks probably block the remote origin, since they\u0027re not explicitly added to the trusted allowlist."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-346 Origin Validation Error"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/open-zaak/open-zaak/security/advisories/GHSA-chhr-gxrg-64x7",
"refsource": "CONFIRM",
"url": "https://github.com/open-zaak/open-zaak/security/advisories/GHSA-chhr-gxrg-64x7"
},
{
"name": "https://github.com/open-zaak/open-zaak/commit/952269269f1b629fce9c94485f83ac13f31d6c46",
"refsource": "MISC",
"url": "https://github.com/open-zaak/open-zaak/commit/952269269f1b629fce9c94485f83ac13f31d6c46"
},
{
"name": "https://github.com/open-zaak/open-zaak/blob/master/CHANGELOG.rst#133-2020-12-17",
"refsource": "MISC",
"url": "https://github.com/open-zaak/open-zaak/blob/master/CHANGELOG.rst#133-2020-12-17"
}
]
},
"source": {
"advisory": "GHSA-chhr-gxrg-64x7",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2020-26251",
"datePublished": "2020-12-18T17:20:13.000Z",
"dateReserved": "2020-10-01T00:00:00.000Z",
"dateUpdated": "2024-08-04T15:56:03.634Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}