PT-2025-13785 · Zulip · Zulip

Published 2025-03-31 · Updated 2025-08-27 · CVE-2025-27149

Positive Technologies (AI Summary)

CVSS v4.0

4.6

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Zulip versions prior to 10.0

Description The data export feature to organization administrators in Zulip leaks private data. This includes the collection of user-agent types identifying specific integrations or HTTP libraries, such as ZulipGitlabWebhook, okhttp, or PycURL, that have been used to access any organization on the server. The "public data" and "with consent" exports contain metadata, including the titles of some topics in private channels, which the administrator otherwise did not have access to. Additionally, the exports include metadata for which users were in a group DM together, without the users' consent.

Recommendations For versions prior to 10.0, update to version 10.0 to resolve the issue. As a temporary workaround, consider restricting access to the data export feature to minimize the risk of private data leakage. Avoid using the data export feature until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-497

Related Identifiers

CVE-2025-27149

GHSA-358P-X39M-99MM

Affected Products

Zulip

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27149.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-27149 · Security Note
• https://osv.dev/vulnerability/CVE-2025-27149 · Vendor Advisory
• https://github.com/zulip/zulip/security/advisories/GHSA-358p-x39m-99mm · Note
• https://t.me/cvedetector/21624 · Telegram Post
• https://twitter.com/CVEnew/status/1906735890644480225 · Twitter Post
• https://t.me/cveNotify/133636 · Telegram Post