CVE-2026-2552
📋 TL;DR
This CVE describes a path traversal vulnerability in ZenTao's Committer component that allows attackers to delete arbitrary files by manipulating the filePath parameter. It affects ZenTao versions up to 21.7.8. The vulnerability requires authenticated access but could lead to data loss or system disruption.
💻 Affected Systems
- ZenTao
📦 What is this software?
Zentao by Zentao
⚠️ Risk & Real-World Impact
Worst Case
Attackers could delete critical system files, configuration files, or application data, potentially causing system crashes, data loss, or service disruption.
Likely Case
Authenticated users could delete application files, configuration files, or user data within the web application directory, leading to application malfunction or data loss.
If Mitigated
With proper access controls and input validation, impact is limited to authorized users deleting files within their permitted scope.
🎯 Exploit Status
Exploitation requires authenticated access; path traversal via filePath parameter manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 21.7.9
Vendor Advisory: https://github.com/ez-lbz/ez-lbz.github.io/issues/11
Restart Required: Yes
Instructions:
1. Backup your ZenTao installation and database. 2. Download ZenTao 21.7.9 or later from official sources. 3. Replace affected files or perform full upgrade. 4. Restart web server and ZenTao services. 5. Verify functionality.
🔧 Temporary Workarounds
Input Validation Enhancement
allAdd server-side validation to sanitize filePath parameter and restrict to allowed directories
Modify editor/control.php to validate filePath against whitelist
Access Restriction
allRestrict access to Committer component to trusted users only
Configure web server ACLs or application permissions
🧯 If You Can't Patch
- Implement strict access controls to limit who can access the Committer component
- Deploy WAF rules to detect and block path traversal attempts in filePath parameter
🔍 How to Verify
Check if Vulnerable:
Check ZenTao version; if version is 21.7.8 or earlier, system is vulnerable. Review editor/control.php for proper input validation.Check Version:
Check ZenTao admin panel or config files for version informationVerify Fix Applied:
After upgrading to 21.7.9+, verify version and test file deletion functionality with malicious filePath inputs.📡 Detection & Monitoring
Log Indicators:
- Unusual file deletion attempts in application logs
- Requests to editor/control.php with suspicious filePath parameters
Network Indicators:
- HTTP requests containing path traversal sequences (../) in filePath parameter
SIEM Query:
web_access_logs WHERE url CONTAINS 'editor/control.php' AND (params CONTAINS '../' OR params CONTAINS '..\\')