What’s Vulnerable › Vulnerabilities

CVE-2022-31134: Zulip Server public data export contains attachments that are non-public

• Severity: medium (CVSS 4.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-07-12 · updated 2026-06-17
• Weakness: CWE-200

Description

Zulip is an open-source team collaboration tool. Zulip Server versions 2.1.0 above have a user interface tool, accessible only to server owners and server administrators, which provides a way to download a "public data" export. While this export is only accessible to administrators, in many configurations server administrators are not expected to have access to private messages and private streams. However, the "public data" export which administrators could generate contained the attachment contents for all attachments, even those from private messages and streams. Zulip Server version 5.4 contains a patch for this issue.

Affected products

• zulip: from 2.1.0 before 5.4 — fixed in 5.4

How to fix

Upgrade to a fixed version: zulip 5.4. Check the vendor advisory for mitigations.

References

• https://blog.zulip.com/2022/07/12/zulip-cloud-data-exports
• https://blog.zulip.com/2022/07/12/zulip-server-5-4-security-release
• https://github.com/zulip/zulip/security/advisories/GHSA-58pm-88xp-7x9m
• https://blog.zulip.com/2022/07/12/zulip-cloud-data-exports
• https://blog.zulip.com/2022/07/12/zulip-server-5-4-security-release
• https://github.com/zulip/zulip/security/advisories/GHSA-58pm-88xp-7x9m

Get alerted when CVE-2022-31134 or the next vulnerability affects your stack