This vulnerability is a path traversal flaw (CWE‑22) in the Zulip import feature. When an export tarball is imported, the server processes the uploads/records.json file without sanitizing file paths. An attacker can craft a tarball that references files outside the intended directory, causing the Zulip process, which runs under the zulip user, to copy any readable file into the uploads directory. The result is unauthorized disclosure of arbitrary server files.

All releases of Zulip from version 1.4.0 up to, but not including, 11.6 are affected. The flaw is triggered by the ./manage.py import command or the web interface that performs the same import operation. Any installation that allows import of export tarballs is vulnerable. The issue was fixed in Zulip 11.6.

The CVSS score of 6.1 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to supply a crafted import tarball and trigger the import, typically available to administrators or authenticated users with import privileges. Once successful, the attacker can read any file that the zulip user can access, potentially revealing sensitive configuration data or credentials, which could facilitate further attacks.