CVE-2025-34508: ZendTo < 6.15-8 Path Traversal

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 73.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-06-17 · updated 2026-06-17
Weakness: CWE-22

Description

A path traversal vulnerability exists in the file dropoff functionality of ZendTo versions 6.15-7 and prior. This could allow a remote, authenticated attacker to retrieve the files of other ZendTo users, retrieve files on the host system, or cause a denial of service.

Affected products

ZendTo: before 6.15-8 — fixed in 6.15-8

How to fix

Upgrade to a fixed version: ZendTo 6.15-8. Check the vendor advisory for mitigations.

References

https://horizon3.ai/attack-research/attack-blogs/cve-2025-34508-another-file-sharing-application-another-path-traversal/
https://www.vulncheck.com/advisories/zendto-path-traversal

Get alerted when CVE-2025-34508 or the next vulnerability affects your stack