Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2025-34508: ZendTo File Dropoff Allows Attackers to Access Other Users' Files
CVE-2025-34508 · published 1 year ago
Summary
ZendTo's file dropoff feature has a security weakness that allows an attacker to access files from other users' accounts. This could also be used to access files on the server or make the system unavailable. Update to a fixed version of ZendTo to protect your users' files and prevent unauthorized access.
Original advisory text
A path traversal vulnerability exists in the file dropoff functionality
of ZendTo versions 6.15-7 and prior. This could allow a remote, authenticated attacker to retrieve the files of other ZendTo...
A path traversal vulnerability exists in the file dropoff functionality
of ZendTo versions 6.15-7 and prior. This could allow a remote, authenticated attacker to retrieve the files of other ZendTo users, retrieve files on the host
system, or cause a denial of service.
of ZendTo versions 6.15-7 and prior. This could allow a remote, authenticated attacker to retrieve the files of other ZendTo users, retrieve files on the host
system, or cause a denial of service.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-22Path Traversal
Timeline
Published17 Jun 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-34508 · NVD
Track software like this
Free during beta