CVE-2026-2552: ZenTao Editor control.php delete path traversal

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-02-16 · updated 2026-06-17
Weakness: CWE-22

Description

A vulnerability was identified in ZenTao up to 21.7.8. Affected by this issue is the function delete of the file editor/control.php of the component Committer. Such manipulation of the argument filePath leads to path traversal. Upgrading to version 21.7.9 can resolve this issue. The affected component should be upgraded.

Affected products

ZenTao: through 21.7.8

References

https://github.com/ez-lbz/ez-lbz.github.io/issues/11
https://github.com/ez-lbz/ez-lbz.github.io/issues/11#issuecomment-3876278793
https://vuldb.com/?ctiid.346161
https://vuldb.com/?id.346161
https://vuldb.com/?submit.749985
https://github.com/ez-lbz/ez-lbz.github.io/issues/11

Get alerted when CVE-2026-2552 or the next vulnerability affects your stack