Search

Find a vulnerability

Search criteria

    6 vulnerabilities by open-zaak

    CVE-2026-55836 (GCVE-0-2026-55836)

    Vulnerability from nvd – Published: 2026-10-16 15:23 – Updated: 2026-10-16 16:01
    VLAI
    Title
    Open Zaak: Path traversal / arbitrary server-file read via Documenten API document import (bestandspad)
    Summary
    Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, _import_document_row in src/openzaak/components/documenten/tasks.py uses the attacker-controlled bestandspad CSV field without ensuring that the resolved path remains under IMPORT_DOCUMENTEN_BASE_DIR. A client with an all-authorizations application token can supply an absolute or parent-traversal path to a file readable by the Celery service account. The worker copies that file into document storage, allowing its contents to be retrieved through the normal document download API and exposing server secrets or other private files. This issue is fixed in versions 1.27.2, 1.28.2, and 1.29.0.
    Severity
    6.8 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-16 16:01 UTC
    CWE
    • CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7639 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    open-zaak open-zaak Affected: >= 1.13.0, < 1.27.2
    Affected: >= 1.28.0, < 1.28.2
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55836",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T16:01:07.670750Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T16:01:37.738Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/open-zaak/open-zaak/security/advisories/GHSA-x5cj-23hr-5r54"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "open-zaak",
          "vendor": "open-zaak",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.13.0, \u003c 1.27.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.28.0, \u003c 1.28.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, _import_document_row in src/openzaak/components/documenten/tasks.py uses the attacker-controlled bestandspad CSV field without ensuring that the resolved path remains under IMPORT_DOCUMENTEN_BASE_DIR. A client with an all-authorizations application token can supply an absolute or parent-traversal path to a file readable by the Celery service account. The worker copies that file into document storage, allowing its contents to be retrieved through the normal document download API and exposing server secrets or other private files. This issue is fixed in versions 1.27.2, 1.28.2, and 1.29.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T15:23:22.783Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/open-zaak/open-zaak/security/advisories/GHSA-x5cj-23hr-5r54",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/open-zaak/open-zaak/security/advisories/GHSA-x5cj-23hr-5r54"
        },
        {
          "name": "https://github.com/open-zaak/open-zaak/commit/4b23957b55ab792bc2ba1fbc5ce6918881b62ab8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-zaak/open-zaak/commit/4b23957b55ab792bc2ba1fbc5ce6918881b62ab8"
        },
        {
          "name": "https://github.com/open-zaak/open-zaak/commit/69c78ce2a0edb45bec8809bc2205585c5f8a4054",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-zaak/open-zaak/commit/69c78ce2a0edb45bec8809bc2205585c5f8a4054"
        },
        {
          "name": "https://github.com/open-zaak/open-zaak/commit/8acd5e59e0132aa19284bf22f7b3defca279e2ce",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-zaak/open-zaak/commit/8acd5e59e0132aa19284bf22f7b3defca279e2ce"
        },
        {
          "name": "https://github.com/open-zaak/open-zaak/releases/tag/1.27.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-zaak/open-zaak/releases/tag/1.27.2"
        },
        {
          "name": "https://github.com/open-zaak/open-zaak/releases/tag/1.28.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-zaak/open-zaak/releases/tag/1.28.2"
        },
        {
          "name": "https://github.com/open-zaak/open-zaak/releases/tag/1.29.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-zaak/open-zaak/releases/tag/1.29.0"
        }
      ],
      "source": {
        "advisory": "GHSA-x5cj-23hr-5r54",
        "discovery": "UNKNOWN"
      },
      "title": "Open Zaak: Path traversal / arbitrary server-file read via Documenten API document import (bestandspad)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55836",
    "datePublished": "2026-10-16T15:23:22.783Z",
    "dateReserved": "2026-06-17T16:29:38.865Z",
    "dateUpdated": "2026-10-16T16:01:37.738Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-54657 (GCVE-0-2026-54657)

    Vulnerability from nvd – Published: 2026-10-16 15:21 – Updated: 2026-10-16 17:06
    VLAI
    Title
    Open Zaak: /zaken/_zoek and /enkelvoudiginformatieobjecten/_zoek endpoints do not filter result lists based on authorizations linked to token
    Summary
    Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST search endpoints /zaken/api/v1/zaken/_zoek and /documenten/api/v1/enkelvoudiginformatieobjecten/_zoek do not filter result querysets according to the authorizations associated with the request token. A caller with a valid zaken.lezen or documenten.lezen token can therefore retrieve case or document metadata outside the token's authorized types or confidentiality levels. Document searches require known UUIDs, and document content remains protected by separate download authorization. This issue is fixed in versions 1.27.2, 1.28.2, and 1.29.0.
    Severity
    6.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-16 16:32 UTC
    CWE
    • CWE-285 - Improper Authorization
    • CWE-639 - Authorization Bypass Through User-Controlled Key
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7639 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    open-zaak open-zaak Affected: >= 1.0.0, < 1.27.2
    Affected: >= 1.28.0, < 1.28.2
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54657",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T16:32:04.577772Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T17:06:31.247Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "open-zaak",
          "vendor": "open-zaak",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.0, \u003c 1.27.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.28.0, \u003c 1.28.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST search endpoints /zaken/api/v1/zaken/_zoek and /documenten/api/v1/enkelvoudiginformatieobjecten/_zoek do not filter result querysets according to the authorizations associated with the request token. A caller with a valid zaken.lezen or documenten.lezen token can therefore retrieve case or document metadata outside the token\u0027s authorized types or confidentiality levels. Document searches require known UUIDs, and document content remains protected by separate download authorization. This issue is fixed in versions 1.27.2, 1.28.2, and 1.29.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T15:21:57.401Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/open-zaak/open-zaak/security/advisories/GHSA-f29q-7rpr-jmjx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/open-zaak/open-zaak/security/advisories/GHSA-f29q-7rpr-jmjx"
        },
        {
          "name": "https://github.com/open-zaak/open-zaak/commit/15456f1a0ef4b0abf1b1c0e3a16c99c15423b9fd",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-zaak/open-zaak/commit/15456f1a0ef4b0abf1b1c0e3a16c99c15423b9fd"
        },
        {
          "name": "https://github.com/open-zaak/open-zaak/commit/4b429d3243d1532f6fe731f932a201cf0ddc4c18",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-zaak/open-zaak/commit/4b429d3243d1532f6fe731f932a201cf0ddc4c18"
        },
        {
          "name": "https://github.com/open-zaak/open-zaak/commit/d3869af98c60570782f867bab3e1d14fd8d8330f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-zaak/open-zaak/commit/d3869af98c60570782f867bab3e1d14fd8d8330f"
        },
        {
          "name": "https://github.com/open-zaak/open-zaak/releases/tag/1.27.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-zaak/open-zaak/releases/tag/1.27.2"
        },
        {
          "name": "https://github.com/open-zaak/open-zaak/releases/tag/1.28.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-zaak/open-zaak/releases/tag/1.28.2"
        },
        {
          "name": "https://github.com/open-zaak/open-zaak/releases/tag/1.29.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-zaak/open-zaak/releases/tag/1.29.0"
        }
      ],
      "source": {
        "advisory": "GHSA-f29q-7rpr-jmjx",
        "discovery": "UNKNOWN"
      },
      "title": "Open Zaak: /zaken/_zoek and /enkelvoudiginformatieobjecten/_zoek endpoints do not filter result lists based on authorizations linked to token"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54657",
    "datePublished": "2026-10-16T15:21:57.401Z",
    "dateReserved": "2026-06-15T20:16:46.199Z",
    "dateUpdated": "2026-10-16T17:06:31.247Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2020-26251 (GCVE-0-2020-26251)

    Vulnerability from nvd – Published: 2020-12-18 17:20 – Updated: 2024-08-04 15:56
    VLAI
    Title
    CORS configuration is possibly vulnerable
    Summary
    Open Zaak is a modern, open-source data- and services-layer to enable zaakgericht werken, a Dutch approach to case management. In Open Zaak before version 1.3.3 the Cross-Origin-Resource-Sharing policy in Open Zaak is currently wide open - every client is allowed. This allows evil.com to run scripts that perform AJAX calls to known Open Zaak installations, and the browser will not block these. This was intended to only apply to development machines running on localhost/127.0.0.1. Open Zaak 1.3.3 disables CORS by default, while it can be opted-in through environment variables. The vulnerability does not actually seem exploitable because: a) The session cookie has a `Same-Site: Lax` policy which prevents it from being sent along in Cross-Origin requests. b) All pages that give access to (production) data are login-protected c) `Access-Control-Allow-Credentials` is set to `false` d) CSRF checks probably block the remote origin, since they're not explicitly added to the trusted allowlist.
    Severity
    4.7 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
    CWE
    • CWE-346 - Origin Validation Error
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7639 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    open-zaak open-zaak Affected: < 1.3.3
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T15:56:03.634Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/open-zaak/open-zaak/security/advisories/GHSA-chhr-gxrg-64x7"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/open-zaak/open-zaak/commit/952269269f1b629fce9c94485f83ac13f31d6c46"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/open-zaak/open-zaak/blob/master/CHANGELOG.rst#133-2020-12-17"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "open-zaak",
          "vendor": "open-zaak",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.3.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Open Zaak is a modern, open-source data- and services-layer to enable zaakgericht werken, a Dutch approach to case management. In Open Zaak before version 1.3.3 the Cross-Origin-Resource-Sharing policy in Open Zaak is currently wide open - every client is allowed. This allows evil.com to run scripts that perform AJAX calls to known Open Zaak installations, and the browser will not block these. This was intended to only apply to development machines running on localhost/127.0.0.1. Open Zaak 1.3.3 disables CORS by default, while it can be opted-in through environment variables. The vulnerability does not actually seem exploitable because: a) The session cookie has a `Same-Site: Lax` policy which prevents it from being sent along in Cross-Origin requests. b) All pages that give access to (production) data are login-protected c) `Access-Control-Allow-Credentials` is set to `false` d) CSRF checks probably block the remote origin, since they\u0027re not explicitly added to the trusted allowlist."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346 Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-12-18T17:20:13.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/open-zaak/open-zaak/security/advisories/GHSA-chhr-gxrg-64x7"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-zaak/open-zaak/commit/952269269f1b629fce9c94485f83ac13f31d6c46"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-zaak/open-zaak/blob/master/CHANGELOG.rst#133-2020-12-17"
        }
      ],
      "source": {
        "advisory": "GHSA-chhr-gxrg-64x7",
        "discovery": "UNKNOWN"
      },
      "title": "CORS configuration is possibly vulnerable",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2020-26251",
          "STATE": "PUBLIC",
          "TITLE": "CORS configuration is possibly vulnerable"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "open-zaak",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 1.3.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "open-zaak"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Open Zaak is a modern, open-source data- and services-layer to enable zaakgericht werken, a Dutch approach to case management. In Open Zaak before version 1.3.3 the Cross-Origin-Resource-Sharing policy in Open Zaak is currently wide open - every client is allowed. This allows evil.com to run scripts that perform AJAX calls to known Open Zaak installations, and the browser will not block these. This was intended to only apply to development machines running on localhost/127.0.0.1. Open Zaak 1.3.3 disables CORS by default, while it can be opted-in through environment variables. The vulnerability does not actually seem exploitable because: a) The session cookie has a `Same-Site: Lax` policy which prevents it from being sent along in Cross-Origin requests. b) All pages that give access to (production) data are login-protected c) `Access-Control-Allow-Credentials` is set to `false` d) CSRF checks probably block the remote origin, since they\u0027re not explicitly added to the trusted allowlist."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-346 Origin Validation Error"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/open-zaak/open-zaak/security/advisories/GHSA-chhr-gxrg-64x7",
              "refsource": "CONFIRM",
              "url": "https://github.com/open-zaak/open-zaak/security/advisories/GHSA-chhr-gxrg-64x7"
            },
            {
              "name": "https://github.com/open-zaak/open-zaak/commit/952269269f1b629fce9c94485f83ac13f31d6c46",
              "refsource": "MISC",
              "url": "https://github.com/open-zaak/open-zaak/commit/952269269f1b629fce9c94485f83ac13f31d6c46"
            },
            {
              "name": "https://github.com/open-zaak/open-zaak/blob/master/CHANGELOG.rst#133-2020-12-17",
              "refsource": "MISC",
              "url": "https://github.com/open-zaak/open-zaak/blob/master/CHANGELOG.rst#133-2020-12-17"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-chhr-gxrg-64x7",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2020-26251",
    "datePublished": "2020-12-18T17:20:13.000Z",
    "dateReserved": "2020-10-01T00:00:00.000Z",
    "dateUpdated": "2024-08-04T15:56:03.634Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2026-55836 (GCVE-0-2026-55836)

    Vulnerability from cvelistv5 – Published: 2026-10-16 15:23 – Updated: 2026-10-16 16:01
    VLAI
    Title
    Open Zaak: Path traversal / arbitrary server-file read via Documenten API document import (bestandspad)
    Summary
    Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, _import_document_row in src/openzaak/components/documenten/tasks.py uses the attacker-controlled bestandspad CSV field without ensuring that the resolved path remains under IMPORT_DOCUMENTEN_BASE_DIR. A client with an all-authorizations application token can supply an absolute or parent-traversal path to a file readable by the Celery service account. The worker copies that file into document storage, allowing its contents to be retrieved through the normal document download API and exposing server secrets or other private files. This issue is fixed in versions 1.27.2, 1.28.2, and 1.29.0.
    Severity
    6.8 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-16 16:01 UTC
    CWE
    • CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7639 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    open-zaak open-zaak Affected: >= 1.13.0, < 1.27.2
    Affected: >= 1.28.0, < 1.28.2
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55836",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T16:01:07.670750Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T16:01:37.738Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/open-zaak/open-zaak/security/advisories/GHSA-x5cj-23hr-5r54"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "open-zaak",
          "vendor": "open-zaak",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.13.0, \u003c 1.27.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.28.0, \u003c 1.28.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, _import_document_row in src/openzaak/components/documenten/tasks.py uses the attacker-controlled bestandspad CSV field without ensuring that the resolved path remains under IMPORT_DOCUMENTEN_BASE_DIR. A client with an all-authorizations application token can supply an absolute or parent-traversal path to a file readable by the Celery service account. The worker copies that file into document storage, allowing its contents to be retrieved through the normal document download API and exposing server secrets or other private files. This issue is fixed in versions 1.27.2, 1.28.2, and 1.29.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T15:23:22.783Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/open-zaak/open-zaak/security/advisories/GHSA-x5cj-23hr-5r54",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/open-zaak/open-zaak/security/advisories/GHSA-x5cj-23hr-5r54"
        },
        {
          "name": "https://github.com/open-zaak/open-zaak/commit/4b23957b55ab792bc2ba1fbc5ce6918881b62ab8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-zaak/open-zaak/commit/4b23957b55ab792bc2ba1fbc5ce6918881b62ab8"
        },
        {
          "name": "https://github.com/open-zaak/open-zaak/commit/69c78ce2a0edb45bec8809bc2205585c5f8a4054",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-zaak/open-zaak/commit/69c78ce2a0edb45bec8809bc2205585c5f8a4054"
        },
        {
          "name": "https://github.com/open-zaak/open-zaak/commit/8acd5e59e0132aa19284bf22f7b3defca279e2ce",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-zaak/open-zaak/commit/8acd5e59e0132aa19284bf22f7b3defca279e2ce"
        },
        {
          "name": "https://github.com/open-zaak/open-zaak/releases/tag/1.27.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-zaak/open-zaak/releases/tag/1.27.2"
        },
        {
          "name": "https://github.com/open-zaak/open-zaak/releases/tag/1.28.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-zaak/open-zaak/releases/tag/1.28.2"
        },
        {
          "name": "https://github.com/open-zaak/open-zaak/releases/tag/1.29.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-zaak/open-zaak/releases/tag/1.29.0"
        }
      ],
      "source": {
        "advisory": "GHSA-x5cj-23hr-5r54",
        "discovery": "UNKNOWN"
      },
      "title": "Open Zaak: Path traversal / arbitrary server-file read via Documenten API document import (bestandspad)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55836",
    "datePublished": "2026-10-16T15:23:22.783Z",
    "dateReserved": "2026-06-17T16:29:38.865Z",
    "dateUpdated": "2026-10-16T16:01:37.738Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-54657 (GCVE-0-2026-54657)

    Vulnerability from cvelistv5 – Published: 2026-10-16 15:21 – Updated: 2026-10-16 17:06
    VLAI
    Title
    Open Zaak: /zaken/_zoek and /enkelvoudiginformatieobjecten/_zoek endpoints do not filter result lists based on authorizations linked to token
    Summary
    Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST search endpoints /zaken/api/v1/zaken/_zoek and /documenten/api/v1/enkelvoudiginformatieobjecten/_zoek do not filter result querysets according to the authorizations associated with the request token. A caller with a valid zaken.lezen or documenten.lezen token can therefore retrieve case or document metadata outside the token's authorized types or confidentiality levels. Document searches require known UUIDs, and document content remains protected by separate download authorization. This issue is fixed in versions 1.27.2, 1.28.2, and 1.29.0.
    Severity
    6.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-16 16:32 UTC
    CWE
    • CWE-285 - Improper Authorization
    • CWE-639 - Authorization Bypass Through User-Controlled Key
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7639 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    open-zaak open-zaak Affected: >= 1.0.0, < 1.27.2
    Affected: >= 1.28.0, < 1.28.2
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54657",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T16:32:04.577772Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T17:06:31.247Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "open-zaak",
          "vendor": "open-zaak",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.0, \u003c 1.27.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.28.0, \u003c 1.28.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST search endpoints /zaken/api/v1/zaken/_zoek and /documenten/api/v1/enkelvoudiginformatieobjecten/_zoek do not filter result querysets according to the authorizations associated with the request token. A caller with a valid zaken.lezen or documenten.lezen token can therefore retrieve case or document metadata outside the token\u0027s authorized types or confidentiality levels. Document searches require known UUIDs, and document content remains protected by separate download authorization. This issue is fixed in versions 1.27.2, 1.28.2, and 1.29.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T15:21:57.401Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/open-zaak/open-zaak/security/advisories/GHSA-f29q-7rpr-jmjx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/open-zaak/open-zaak/security/advisories/GHSA-f29q-7rpr-jmjx"
        },
        {
          "name": "https://github.com/open-zaak/open-zaak/commit/15456f1a0ef4b0abf1b1c0e3a16c99c15423b9fd",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-zaak/open-zaak/commit/15456f1a0ef4b0abf1b1c0e3a16c99c15423b9fd"
        },
        {
          "name": "https://github.com/open-zaak/open-zaak/commit/4b429d3243d1532f6fe731f932a201cf0ddc4c18",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-zaak/open-zaak/commit/4b429d3243d1532f6fe731f932a201cf0ddc4c18"
        },
        {
          "name": "https://github.com/open-zaak/open-zaak/commit/d3869af98c60570782f867bab3e1d14fd8d8330f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-zaak/open-zaak/commit/d3869af98c60570782f867bab3e1d14fd8d8330f"
        },
        {
          "name": "https://github.com/open-zaak/open-zaak/releases/tag/1.27.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-zaak/open-zaak/releases/tag/1.27.2"
        },
        {
          "name": "https://github.com/open-zaak/open-zaak/releases/tag/1.28.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-zaak/open-zaak/releases/tag/1.28.2"
        },
        {
          "name": "https://github.com/open-zaak/open-zaak/releases/tag/1.29.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-zaak/open-zaak/releases/tag/1.29.0"
        }
      ],
      "source": {
        "advisory": "GHSA-f29q-7rpr-jmjx",
        "discovery": "UNKNOWN"
      },
      "title": "Open Zaak: /zaken/_zoek and /enkelvoudiginformatieobjecten/_zoek endpoints do not filter result lists based on authorizations linked to token"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54657",
    "datePublished": "2026-10-16T15:21:57.401Z",
    "dateReserved": "2026-06-15T20:16:46.199Z",
    "dateUpdated": "2026-10-16T17:06:31.247Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2020-26251 (GCVE-0-2020-26251)

    Vulnerability from cvelistv5 – Published: 2020-12-18 17:20 – Updated: 2024-08-04 15:56
    VLAI
    Title
    CORS configuration is possibly vulnerable
    Summary
    Open Zaak is a modern, open-source data- and services-layer to enable zaakgericht werken, a Dutch approach to case management. In Open Zaak before version 1.3.3 the Cross-Origin-Resource-Sharing policy in Open Zaak is currently wide open - every client is allowed. This allows evil.com to run scripts that perform AJAX calls to known Open Zaak installations, and the browser will not block these. This was intended to only apply to development machines running on localhost/127.0.0.1. Open Zaak 1.3.3 disables CORS by default, while it can be opted-in through environment variables. The vulnerability does not actually seem exploitable because: a) The session cookie has a `Same-Site: Lax` policy which prevents it from being sent along in Cross-Origin requests. b) All pages that give access to (production) data are login-protected c) `Access-Control-Allow-Credentials` is set to `false` d) CSRF checks probably block the remote origin, since they're not explicitly added to the trusted allowlist.
    Severity
    4.7 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
    CWE
    • CWE-346 - Origin Validation Error
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7639 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    open-zaak open-zaak Affected: < 1.3.3
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T15:56:03.634Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/open-zaak/open-zaak/security/advisories/GHSA-chhr-gxrg-64x7"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/open-zaak/open-zaak/commit/952269269f1b629fce9c94485f83ac13f31d6c46"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/open-zaak/open-zaak/blob/master/CHANGELOG.rst#133-2020-12-17"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "open-zaak",
          "vendor": "open-zaak",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.3.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Open Zaak is a modern, open-source data- and services-layer to enable zaakgericht werken, a Dutch approach to case management. In Open Zaak before version 1.3.3 the Cross-Origin-Resource-Sharing policy in Open Zaak is currently wide open - every client is allowed. This allows evil.com to run scripts that perform AJAX calls to known Open Zaak installations, and the browser will not block these. This was intended to only apply to development machines running on localhost/127.0.0.1. Open Zaak 1.3.3 disables CORS by default, while it can be opted-in through environment variables. The vulnerability does not actually seem exploitable because: a) The session cookie has a `Same-Site: Lax` policy which prevents it from being sent along in Cross-Origin requests. b) All pages that give access to (production) data are login-protected c) `Access-Control-Allow-Credentials` is set to `false` d) CSRF checks probably block the remote origin, since they\u0027re not explicitly added to the trusted allowlist."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346 Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-12-18T17:20:13.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/open-zaak/open-zaak/security/advisories/GHSA-chhr-gxrg-64x7"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-zaak/open-zaak/commit/952269269f1b629fce9c94485f83ac13f31d6c46"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-zaak/open-zaak/blob/master/CHANGELOG.rst#133-2020-12-17"
        }
      ],
      "source": {
        "advisory": "GHSA-chhr-gxrg-64x7",
        "discovery": "UNKNOWN"
      },
      "title": "CORS configuration is possibly vulnerable",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2020-26251",
          "STATE": "PUBLIC",
          "TITLE": "CORS configuration is possibly vulnerable"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "open-zaak",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 1.3.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "open-zaak"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Open Zaak is a modern, open-source data- and services-layer to enable zaakgericht werken, a Dutch approach to case management. In Open Zaak before version 1.3.3 the Cross-Origin-Resource-Sharing policy in Open Zaak is currently wide open - every client is allowed. This allows evil.com to run scripts that perform AJAX calls to known Open Zaak installations, and the browser will not block these. This was intended to only apply to development machines running on localhost/127.0.0.1. Open Zaak 1.3.3 disables CORS by default, while it can be opted-in through environment variables. The vulnerability does not actually seem exploitable because: a) The session cookie has a `Same-Site: Lax` policy which prevents it from being sent along in Cross-Origin requests. b) All pages that give access to (production) data are login-protected c) `Access-Control-Allow-Credentials` is set to `false` d) CSRF checks probably block the remote origin, since they\u0027re not explicitly added to the trusted allowlist."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-346 Origin Validation Error"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/open-zaak/open-zaak/security/advisories/GHSA-chhr-gxrg-64x7",
              "refsource": "CONFIRM",
              "url": "https://github.com/open-zaak/open-zaak/security/advisories/GHSA-chhr-gxrg-64x7"
            },
            {
              "name": "https://github.com/open-zaak/open-zaak/commit/952269269f1b629fce9c94485f83ac13f31d6c46",
              "refsource": "MISC",
              "url": "https://github.com/open-zaak/open-zaak/commit/952269269f1b629fce9c94485f83ac13f31d6c46"
            },
            {
              "name": "https://github.com/open-zaak/open-zaak/blob/master/CHANGELOG.rst#133-2020-12-17",
              "refsource": "MISC",
              "url": "https://github.com/open-zaak/open-zaak/blob/master/CHANGELOG.rst#133-2020-12-17"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-chhr-gxrg-64x7",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2020-26251",
    "datePublished": "2020-12-18T17:20:13.000Z",
    "dateReserved": "2020-10-01T00:00:00.000Z",
    "dateUpdated": "2024-08-04T15:56:03.634Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}