Skip to content
OpenAdvisories

Vendor

open-zaak

3 known vulnerabilities.

Products

open-zaak 3
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.8
    CVE-2026-55836

    Open Zaak: Path traversal / arbitrary server-file read via Documenten API document import (bestandspad)

    Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, _import_document_row in src/openzaak/components/documenten/tasks.py uses the attacker-controlled bestandspad CSV field without e…

    open-zaak open-zaak
  • Medium 6.5
    CVE-2026-54657

    Open Zaak: /zaken/_zoek and /enkelvoudiginformatieobjecten/_zoek endpoints do not filter result lists based on authorizations linked to token

    Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST search endpoints /zaken/api/v1/zaken/_zoek and /documenten/api/v1/enkelvoudiginformatieobjecten/_zoek do not filter resu…

    open-zaak open-zaak
  • Medium 4.7
    CVE-2020-26251

    CORS configuration is possibly vulnerable

    Open Zaak is a modern, open-source data- and services-layer to enable zaakgericht werken, a Dutch approach to case management. In Open Zaak before version 1.3.3 the Cross-Origin-Resource-Sharing policy in Open Zaak is currently wide open - every client is all…

    open-zaak open-zaak