CVE-2026-2552CWE-22

ZenTao Editor control.php delete path traversal

Medium · published February 16, 2026

CVSS v4.0
5.1
EPSS
0%
Percentile
37.1
In the wild
Unconfirmed
What it is

A vulnerability was identified in ZenTao up to 21.7.8. Affected by this issue is the function delete of the file editor/control.php of the component Committer. Such manipulation of the argument filePath leads to path traversal. Upgrading to version 21.7.9 can resolve this issue. The affected component should be upgraded.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
EPSS
0.00439 · 37.1th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-02-16T11:02Z
EPSS history
Timeline
  • 16 FEB 11:02Z
    ZenTao Editor control.php delete path traversal
    cvelistv5