CVE-2025-13789: ZenTao model.php makeRequest server-side request forgery
A vulnerability was found in ZenTao up to 21.7.6-8564. This affects the function makeRequest of the file module/ai/model.php. The manipulation of the argument Base results in server-side request forgery. The attack can be launched remotely. The exploit has been made public and could be used. Upgrading to version 21.7.6 mitigates this issue. It is suggested to upgrade the affected component.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-13789?
CVE-2025-13789 is considered a critical vulnerability due to its potential for server-side request forgery.
How do I fix CVE-2025-13789?
To mitigate CVE-2025-13789, upgrade ZenTao to version 21.7.7 or later to eliminate the vulnerability.
What versions of ZenTao are affected by CVE-2025-13789?
CVE-2025-13789 affects ZenTao versions up to and including 21.7.6-8564.
Can CVE-2025-13789 be exploited remotely?
Yes, CVE-2025-13789 can be exploited remotely, allowing attackers to perform server-side request forgery.
What is the primary impact of CVE-2025-13789?
The primary impact of CVE-2025-13789 is that it allows unauthorized network access via server-side request forgery.