Is CVE-2026-26058 actively exploited?

No active exploitation of CVE-2026-26058 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-26058 be exploited remotely?

No. CVE-2026-26058 requires local access to exploit.

What is the CVSS score of CVE-2026-26058?

CVE-2026-26058 has a CVSS score of 6.1 (MEDIUM).

HOME VULNERABILITIESCVE-2026-26058

MEDIUM

CVE-2026-26058

CWE-22Published: April 3, 2026· Updated: Apr 7, 2026

6.1

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:1.2th

Official Description

Zulip is an open-source team collaboration tool. From version 1.4.0 to before version 11.6, ./manage.py import reads arbitrary files from the server filesystem via path traversal in uploads/records.json. A crafted export tarball causes the server to copy any file the zulip user can read into the uploads directory during import. This issue has been patched in version 11.6.

NVD Source

Technical Analysis

CVE-2026-26058 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 6.1.