PT-2026-8334 · Zentao · Zentao

Ez-Lbz · Published 2026-02-16 · Updated 2026-02-16 · CVE-2026-2551

Positive Technologies · (AI Summary)

CVSS v2.0

5.5

Medium

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions ZenTao versions prior to 21.7.9

Description A flaw exists in ZenTao up to version 21.7.8 related to path traversal. The issue is located within the delete function of the editor/control.php file, part of the Backup Handler component. Manipulation of the fileName argument can lead to unauthorized file access. This issue can be triggered remotely, and details of the exploit are publicly available.

Recommendations Update to version 21.7.9 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-2551

Affected Products

Zentao

References · 8

• 🔥 https://github.com/ez-lbz/ez-lbz.github.io/issues/10 · Exploit
• https://osv.dev/vulnerability/CVE-2026-2551 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2551 · Security Note
• https://vuldb.com/?ctiid.346160 · Note
• https://t.me/CVEtracker/44812 · Telegram Post
• https://vuldb.com/?submit.749983 · Note
• https://vuldb.com/?id.346160 · Note
• https://t.me/cveNotify/152110 · Telegram Post