CVE-2026-55836: Open Zaak: Path traversal / arbitrary server-file read via Documenten API document import (bestandspad)
Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, importdocumentrow in src/openzaak/components/documenten/tasks.py uses the attacker-controlled bestandspad CSV field without ensuring that the resolved path remains under IMPORTDOCUMENTENBASEDIR. A client with an all-authorizations application token can supply an absolute or parent-traversal path to a file readable by the Celery service account. The worker copies that file into document storage, allowing its contents to be retrieved through the normal document download API and exposing server secrets or other private files. This issue is fixed in versions 1.27.2, 1.28.2, and 1.29.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Open Zaakto a version that resolves this vulnerability.Fixed in 1.27.2 - Upgrade
Upgrade
Open Zaakto a version that resolves this vulnerability.Fixed in 1.28.2 - Upgrade
Upgrade
Open Zaakto a version that resolves this vulnerability.Fixed in 1.29.0
Event History
Frequently Asked Questions
Which deployments are affected?
Open Zaak versions from 1.13.0 through the releases before 1.27.2, 1.28.2, and 1.29.0 are affected. The issue is fixed in 1.27.2, 1.28.2, and 1.29.0.
What access does an attacker need?
An attacker needs an application token with all authorizations and the ability to submit a document-import CSV containing the bestandspad field. They can provide an absolute path or a path using parent-directory traversal.
What data could be exposed?
Any file readable by the Celery service account may be copied into Open Zaak document storage. Its contents can then be retrieved through the normal document download API, potentially exposing server secrets or other private files.
How can I determine whether a system may have been exploited?
Review document-import CSV submissions for bestandspad values containing absolute paths or parent-directory traversal. Also investigate imported documents that may correspond to files readable by the Celery service account rather than expected import-directory files.