PT-2025-15052 · Zendto · Zendto

Published 2025-03-31 · Updated 2025-05-02 · CVE-2021-47667

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ZendTo versions 5.24-3 through 6.x before 6.10-7

Description An OS command injection issue in lib/NSSDropoff.php allows unauthenticated remote attackers to execute arbitrary commands via shell metacharacters in the tmp name parameter when dropping off a file via a POST "/dropoff" request.

Recommendations For versions 5.24-3 through 6.x before 6.10-7, update to version 6.10-7 or later to resolve the issue. As a temporary workaround, consider restricting access to the lib/NSSDropoff.php file or disabling the tmp name parameter in the affected API endpoint until a patch is available.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2026-00884

CVE-2021-47667

Affected Products

Zendto

References · 10

• 🔥 https://projectblack.io/blog/zendto-nday-vulnerabilities · Exploit
• https://bdu.fstec.ru/vul/2026-00884 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-47667 · Security Note
• https://t.me/cvetracker/20881 · Telegram Post
• https://twitter.com/CVEnew/status/1908438438795157796 · Twitter Post
• https://t.me/cvenotify/117929 · Telegram Post
• https://t.me/cvedetector/22185 · Telegram Post
• https://t.me/cvenotify/117931 · Telegram Post
• https://twitter.com/cybercronai/status/1908566646928588870 · Twitter Post
• https://twitter.com/transilienceai/status/1918278208983626024 · Twitter Post