zulip vulnerabilities
CVEs whose affected-version data names the zulip package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-26058Medium· 6.1Zulip is an open-source team collaboration tool
Zulip is an open-source team collaboration tool. From version 1.4.0 to before version 11.6, ./manage.py import reads arbitrary files from the server filesystem via path traversal in uploads/records.json. A crafted export tarball causes t…
▾ Sunlitzulip · zulipEPSS 0.24%via NVD
CVE-2026-25742Medium· 5.3Zulip is an open-source team collaboration tool
Zulip is an open-source team collaboration tool. Prior to version 11.6, Zulip is an open-source team collaboration tool. From version 1.4.0 to before version 11.6, even after spectator access (enable_spectator_access / WEB_PUBLIC_STREAMS…
▾ Sunlitzulip · zulipEPSS 0.31%via NVD