Path Traversal Vulnerability in ZenTao by Easysoft
CVE-2026-2552

5.1MEDIUM

Key Information:

Vendor

Easysoft

Status
Zentao
Vendor
CVE Published:
16 February 2026

What is CVE-2026-2552?

A path traversal vulnerability exists in the delete function of the editor/control.php component in ZenTao versions up to 21.7.8. This flaw allows an attacker to manipulate the filePath argument, potentially leading to unauthorized file deletion on the server. To mitigate this risk, it is essential to upgrade to ZenTao version 21.7.9 or higher. Addressing this vulnerability not only secures the software but also protects sensitive files from being compromised.

Affected Version(s)

ZenTao 21.7.0

ZenTao 21.7.1

ZenTao 21.7.2

References

https://vuldb.com/?id.346161
vdb-entrytechnical-description
https://vuldb.com/?ctiid.346161
signaturepermissions-required
https://vuldb.com/?submit.749985
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ez-lbz (VulDB User)
.