CVE-2026-2552: A vulnerability was identified in ZenTao up to 21.7.8. Affected by this issue is the function delete of the file editor/control.php of the component Committer. Such manipulation of the argument fil...

Summary

A vulnerability was identified in ZenTao up to 21.7.8. Affected by this issue is the function delete of the file editor/control.php of the component Committer. Such manipulation of the argument filePath leads to path traversal. Upgrading to version 21.7.9 can resolve this issue. The affected compone...

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
zentao	zentao	<= 21.7.8 `cpe:2.3:a:zentao:zentao::::::::`

Original advisory text

A vulnerability was identified in ZenTao up to 21.7.8. Affected by this issue is the function delete of the file editor/control.php of the component Committer. Such manipulation of the argument fil...

A vulnerability was identified in ZenTao up to 21.7.8. Affected by this issue is the function delete of the file editor/control.php of the component Committer. Such manipulation of the argument filePath leads to path traversal. Upgrading to version 21.7.9 can resolve this issue. The affected component should be upgraded.

References

https://github.com/ez-lbz/ez-lbz.github.io/issues/11#issuecomment-3876278793 Exploit Issue Tracking
https://vuldb.com/?ctiid.346161 Permissions Required VDB Entry
https://vuldb.com/?id.346161 Third Party Advisory VDB Entry
https://vuldb.com/?submit.749985 Third Party Advisory VDB Entry
https://github.com/ez-lbz/ez-lbz.github.io/issues/11 Exploit Issue Tracking