CVE-2026-2551

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability was determined in ZenTao up to 21.7.8. Affected by this vulnerability is the function delete of the file editor/control.php of the component Backup Handler. This manipulation of the argument fileName causes path traversal. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	ZenTao	21.7.0; 21.7.1; 21.7.2; 21.7.3; 21.7.4; 21.7.5; 21.7.6; 21.7.7; 21.7.8

References

https://github.com/ez-lbz/ez-lbz.github.io/issues/10Exploit, Issue Tracking
https://vuldb.com/?ctiid.346160Permissions Required, VDB Entry
https://vuldb.com/?id.346160Third Party Advisory, VDB Entry
https://vuldb.com/?submit.749983Third Party Advisory, VDB Entry

Timeline

Published: Feb 16, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-255108.8CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support CVE-2026-255114.9Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.150, 25.0.82, and 26.0.5, an authen CVE-2026-255128.8Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.150, 25.0.82, and 26.0.5, there is CVE-2026-255138.8FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a crit CVE-2026-255148.8FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a crit CVE-2026-255166.1NiceGUI is a Python-based UI framework. The ui.markdown() component uses the markdown2 library to convert markdown content to HTML, which is CVE-2026-255172.7Wagtail is an open source content management system built on Django. Prior to versions 6.3.6, 7.0.4, 7.1.3, 7.2.2, and 7.3, due to a missing CVE-2026-255185.9cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, re CVE-2026-255199.8OpenSlides is a free, web based presentation and assembly system for managing and projecting agenda, motions and elections of an assembly. P CVE-2026-25525.5A vulnerability was identified in ZenTao up to 21.7.8. Affected by this issue is the function delete of the file editor/control.php of the c CVE-2026-2552010.0SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, The return values of functions aren't wrapped. Object.values/Object.entries c CVE-2026-255218.8Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a pr