PT-2025-48391 · Zentao · Zentao

Ez-Lbz · Published 2025-11-30 · Updated 2025-12-04 · CVE-2025-13789

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions ZenTao versions up to 21.7.6-8564

Description A server-side request forgery condition exists in ZenTao. The issue is related to the makeRequest function within the module/ai/model.php file. Manipulation of the Base argument can trigger the issue. The attack can be launched remotely. The exploit has been made public.

Recommendations Upgrade to version 21.7.6 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-13789

Affected Products

Zentao

References · 14

• 🔥 https://github.com/ez-lbz/ez-lbz.github.io/issues/2#issue-3598317459 · Exploit
• 🔥 https://github.com/ez-lbz/ez-lbz.github.io/issues/2#issuecomment-3540247346 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-13789 · Security Note
• https://zentao.net/extension-viewext-6.html · Patch
• https://github.com/ez-lbz/ez-lbz.github.io/issues/2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-13789 · Vendor Advisory
• https://t.me/CVEtracker/38488 · Telegram Post
• https://twitter.com/dailycve/status/1996658665030656407 · Twitter Post
• https://vuldb.com/?submit.690728 · Note
• https://t.me/cveNotify/144346 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1995138405676589301 · Twitter Post
• https://vuldb.com/?ctiid.333793 · Note
• https://vuldb.com/?id.333793 · Note
• https://twitter.com/CVEnew/status/1995125015239606721 · Twitter Post