What’s Vulnerable › Vulnerabilities

CVE-2016-20029: ZKTeco ZKBioSecurity 3.0 File Path Manipulation Vulnerability

• Severity: medium (CVSS 6.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-16 · updated 2026-06-17
• Weakness: CWE-276

Description

ZKTeco ZKBioSecurity 3.0 contains a file path manipulation vulnerability that allows attackers to access arbitrary files by modifying file paths used to retrieve local resources. Attackers can manipulate path parameters to bypass access controls and retrieve sensitive information including configuration files, source code, and protected application resources.

Affected products

• ZKTeco Inc. ZKTeco ZKBioSecurity: 3.0.1.0_R_230

References

• https://cxsecurity.com/issue/WLB-2016090001
• https://exchange.xforce.ibmcloud.com/vulnerabilities/116489
• https://packetstormsecurity.com/files/138570
• https://www.exploit-db.com/exploits/40326/
• https://www.vulncheck.com/advisories/zkteco-zkbiosecurity-file-path-manipulation-vulnerability
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5365.php

Get alerted when CVE-2016-20029 or the next vulnerability affects your stack