Aggregates CVE and security vulnerability intelligence across all zentao-related products, including CVSS, EPSS, publication dates, and vulnerability intelligence data.
Historical issues mainly involve vendor risk cross-site scripting and vendor risk ssrf and related problems; some flaws may lead to vendor impact file overwrite, affecting vendor surface software deployment scenarios.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2026-2552 | A vulnerability was identified in ZenTao up to 21.7.8. Affected by this issue is the function delete of the file editor/control.php of the component Committer. Such manipulation of the argument filePath leads to path traversal. Upgrading to version 21.7.9 can resolve this issue. The affected component should be upgraded. | [email protected] | 5.1 | 0.05% | 2026-02-16 | 2026-02-20 |
| CVE-2026-2551 | A vulnerability was determined in ZenTao up to 21.7.8. Affected by this vulnerability is the function delete of the file editor/control.php of the component Backup Handler. This manipulation of the argument fileName causes path traversal. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. | [email protected] | 2.1 | 0.05% | 2026-02-16 | 2026-04-29 |
| CVE-2026-1884 | A weakness has been identified in ZenTao up to 21.7.6-85642. The impacted element is the function fetchHook of the file module/webhook/model.php of the component Webhook Module. This manipulation causes server-side request forgery. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | [email protected] | 2.0 | 0.03% | 2026-02-04 | 2026-04-29 |
| CVE-2025-13789 | A vulnerability was found in ZenTao up to 21.7.6-8564. This affects the function makeRequest of the file module/ai/model.php. The manipulation of the argument Base results in server-side request forgery. The attack can be launched remotely. The exploit has been made public and could be used. Upgrading to version 21.7.6 mitigates this issue. It is suggested to upgrade the affected component. | [email protected] | 2.1 | 0.03% | 2025-11-30 | 2026-04-29 |
| CVE-2025-13787 | A flaw has been found in ZenTao up to 21.7.6-8564. The affected element is the function file::delete of the file module/file/control.php of the component File Handler. Executing manipulation of the argument fileID can lead to improper privilege management. It is possible to launch the attack remotely. Upgrading to version 21.7.7 is sufficient to fix this issue. You should upgrade the affected component. | [email protected] | 5.3 | 0.06% | 2025-11-30 | 2025-12-04 |
| CVE-2023-46376 | Zentao Biz version 8.7 and before is vulnerable to Information Disclosure. | [email protected] | 7.5 | 0.04% | 2023-10-27 | 2024-11-21 |
| CVE-2023-46375 | ZenTao Biz version 4.1.3 and before is vulnerable to Cross Site Request Forgery (CSRF). | [email protected] | 8.8 | 0.06% | 2023-10-27 | 2024-11-21 |
| CVE-2023-46491 | ZenTao Biz version 4.1.3 and before has a Cross Site Scripting (XSS) vulnerability in the Version Library. | [email protected] | 6.1 | 0.09% | 2023-10-27 | 2024-11-21 |
| CVE-2023-46374 | ZenTao Enterprise Edition version 4.1.3 and before is vulnerable to Cross Site Scripting (XSS). | [email protected] | 6.1 | 0.09% | 2023-10-27 | 2024-11-21 |