CVE-2025-13787: ZenTao File control.php delete privileges management
A flaw has been found in ZenTao up to 21.7.6-8564. The affected element is the function file::delete of the file module/file/control.php of the component File Handler. Executing manipulation of the argument fileID can lead to improper privilege management. It is possible to launch the attack remotely. Upgrading to version 21.7.7 is sufficient to fix this issue. You should upgrade the affected component.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-13787?
CVE-2025-13787 is considered a high severity vulnerability due to its potential for improper privilege management.
How do I fix CVE-2025-13787?
To fix CVE-2025-13787, ensure that you update ZenTao File Handler to a version beyond 21.7.6-8564.
What component is affected in CVE-2025-13787?
CVE-2025-13787 affects the file::delete function in the file module of the File Handler component.
What can be exploited in CVE-2025-13787?
CVE-2025-13787 can be exploited by manipulating the argument fileID, leading to improper privilege management.
Which versions of ZenTao are vulnerable to CVE-2025-13787?
ZenTao versions up to and including 21.7.6-8564 are vulnerable to CVE-2025-13787.