CVE-2026-2551: ZenTao Backup control.php delete path traversal
A vulnerability was determined in ZenTao up to 21.7.8. Affected by this vulnerability is the function delete of the file editor/control.php of the component Backup Handler. This manipulation of the argument fileName causes path traversal. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2551?
CVE-2026-2551 has been classified with a high severity due to the potential for exploitation through path traversal.
How do I fix CVE-2026-2551?
To fix CVE-2026-2551, upgrade ZenTao to version 21.7.9 or later, which addresses the vulnerability.
What software is affected by CVE-2026-2551?
CVE-2026-2551 affects ZenTao versions up to and including 21.7.8.
What is the nature of the vulnerability identified in CVE-2026-2551?
CVE-2026-2551 is a path traversal vulnerability that allows attackers to manipulate file paths in the Backup Handler.
Can CVE-2026-2551 be exploited remotely?
Yes, CVE-2026-2551 can be exploited remotely if an attacker has access to the vulnerable component.