CVE-2026-2551

ZenTao Backup control.php delete path traversal

State: Published
Severity: 5.3 Medium
Published: Feb 16, 2026
Updated: Feb 23, 2026
Reserved: Feb 15, 2026

Description

A vulnerability was determined in ZenTao up to 21.7.8. Affected by this vulnerability is the function delete of the file editor/control.php of the component Backup Handler. This manipulation of the argument fileName causes path traversal. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	5.4 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R	VulDB
3.0	5.4 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R	VulDB
2.0	5.5 Medium	AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-22 Path Traversal

Affected Products

Product	Versions
ZenTaon/a	21.7.0Affected 21.7.1Affected 21.7.2Affected 21.7.3Affected 21.7.4Affected 21.7.5Affected 21.7.6Affected 21.7.7Affected 21.7.8Affected

References

VDB-346160 | ZenTao Backup control.php delete path traversalvdb-entrytechnical-description
VDB-346160 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #749983 | Zentao PMS <=21.7.8 Arbitrary File Deletionthird-party-advisory
https://github.com/ez-lbz/ez-lbz.github.io/issues/10exploitissue-tracking

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.