PT-2025-48389 · Zentao · Zentao

Ez-Lbz · Published 2025-11-30 · Updated 2025-12-26 · CVE-2025-13787

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions ZenTao versions up to 21.7.6-8564

Description A flaw exists in ZenTao related to improper privilege management. The issue is located in the file::delete function within the module/file/control.php file of the File Handler component. Manipulation of the fileID argument can lead to this issue, and it is possible to launch an attack remotely.

Recommendations Upgrade to version 21.7.7 to resolve the issue.

Exploit

Fix

LPE

Improper Privilege Management

Incorrect Privilege Assignment

Weakness Enumeration

CWE-269

CWE-266

Related Identifiers

CVE-2025-13787

Affected Products

Zentao

References · 14

• 🔥 https://github.com/ez-lbz/ez-lbz.github.io/issues/1#issuecomment-3540423868 · Exploit
• 🔥 https://github.com/ez-lbz/ez-lbz.github.io/issues/1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-13787 · Security Note
• https://zentao.net/extension-buyext-1601-download.html · Patch
• https://osv.dev/vulnerability/CVE-2025-13787 · Vendor Advisory
• https://vuldb.com/?id.333791 · Note
• https://twitter.com/SecReportCVE/status/2004612132655005977 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1995092285638197567 · Twitter Post
• https://vuldb.com/?submit.689892 · Note
• https://twitter.com/dailycve/status/1996651883222708460 · Twitter Post
• https://t.me/cveNotify/144344 · Telegram Post
• https://twitter.com/CVEnew/status/1995083021335052318 · Twitter Post
• https://vuldb.com/?ctiid.333791 · Note
• https://t.me/CVEtracker/38486 · Telegram Post