CVE-2025-13787
📋 TL;DR
This vulnerability in ZenTao's file handler allows attackers to manipulate file deletion operations through improper privilege management. Attackers can exploit this remotely to delete files they shouldn't have access to. Organizations using ZenTao up to version 21.7.6-8564 are affected.
💻 Affected Systems
- ZenTao
📦 What is this software?
Zentao by Zentao
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized deletion of critical system files leading to service disruption, data loss, or system compromise.
Likely Case
Unauthorized deletion of application files causing functionality loss or data integrity issues.
If Mitigated
Minimal impact with proper access controls and file permission restrictions in place.
🎯 Exploit Status
The vulnerability allows remote exploitation without authentication, making it relatively easy to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 21.7.7
Vendor Advisory: Not provided in references
Restart Required: Yes
Instructions:
1. Backup your ZenTao installation and database. 2. Download ZenTao version 21.7.7 or later from official sources. 3. Follow the official ZenTao upgrade documentation. 4. Restart the ZenTao service after upgrade.
🔧 Temporary Workarounds
Restrict network access
allLimit access to ZenTao to trusted networks only
Use firewall rules to restrict access to ZenTao ports
Implement WAF rules
allBlock suspicious file deletion requests
Configure WAF to monitor and block abnormal file deletion patterns
🧯 If You Can't Patch
- Implement strict network segmentation to isolate ZenTao from untrusted networks
- Enable detailed logging and monitoring for file deletion operations
🔍 How to Verify
Check if Vulnerable:
Check ZenTao version in admin panel or via version file in installation directoryCheck Version:
Check /path/to/zentaopms/VERSION file or admin panelVerify Fix Applied:
Verify version is 21.7.7 or higher after upgrade📡 Detection & Monitoring
Log Indicators:
- Multiple file deletion requests from single IP
- File deletion requests with unusual fileID parameters
- Failed file deletion attempts with error messages
Network Indicators:
- HTTP requests to file deletion endpoints with manipulated parameters
- Unusual traffic patterns to file handler components
SIEM Query:
source="zentaopms" AND (uri="*/file/delete*" OR method="POST" AND uri="*/file/*") AND status=200🔗 References
- https://github.com/ez-lbz/ez-lbz.github.io/issues/1
- https://github.com/ez-lbz/ez-lbz.github.io/issues/1#issuecomment-3540423868
- https://vuldb.com/?ctiid.333791
- https://vuldb.com/?id.333791
- https://vuldb.com/?submit.689892
- https://www.zentao.net/extension-buyext-1601-download.html
- https://github.com/ez-lbz/ez-lbz.github.io/issues/1
- https://github.com/ez-lbz/ez-lbz.github.io/issues/1#issuecomment-3540423868
