CVE-2026-2552

ZenTao Editor control.php delete path traversal

State: Published
Severity: 5.1 Medium
Published: Feb 16, 2026
Updated: Feb 23, 2026
Reserved: Feb 15, 2026

Description

A vulnerability was identified in ZenTao up to 21.7.8. Affected by this issue is the function delete of the file editor/control.php of the component Committer. Such manipulation of the argument filePath leads to path traversal. Upgrading to version 21.7.9 can resolve this issue. The affected component should be upgraded.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X	VulDB
3.1	5.5 Medium	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C	VulDB
3.0	5.5 Medium	CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C	VulDB
2.0	5.2 Medium	AV:A/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C	VulDB

Weaknesses

CWE-22 Path Traversal

Affected Products

Product	Versions
ZenTaon/a	21.7.0Affected 21.7.1Affected 21.7.2Affected 21.7.3Affected 21.7.4Affected 21.7.5Affected 21.7.6Affected 21.7.7Affected 21.7.8Affected 21.7.9Not affected

References

VDB-346161 | ZenTao Editor control.php delete path traversalvdb-entrytechnical-description
VDB-346161 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #749985 | Zentao PMS <=21.7.8 Arbitrary File Deletionthird-party-advisory
https://github.com/ez-lbz/ez-lbz.github.io/issues/11issue-tracking
https://github.com/ez-lbz/ez-lbz.github.io/issues/11#issuecomment-3876278793issue-tracking

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.