https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-2552.htmlhttps://patchthecve.com/cve/CVE-2026-2552.htmlWed, 17 Jun 2026 10:31:18 +0000MEDIUM 5.5: A vulnerability was identified in ZenTao up to 21.7.8. Affected by this issue is the function delete of the file editor/control.php of the component Committer. Such manipulation of the argument filePath leads to path traversal. Upgrading to version 21.7.9 can resolve this issue. The affected componehttps://patchthecve.com/cve/CVE-2026-2551.htmlhttps://patchthecve.com/cve/CVE-2026-2551.htmlWed, 17 Jun 2026 10:31:17 +0000MEDIUM 5.4: A vulnerability was determined in ZenTao up to 21.7.8. Affected by this vulnerability is the function delete of the file editor/control.php of the component Backup Handler. This manipulation of the argument fileName causes path traversal. It is possible to initiate the attack remotely. The exploit hhttps://patchthecve.com/cve/CVE-2026-1884.htmlhttps://patchthecve.com/cve/CVE-2026-1884.htmlWed, 17 Jun 2026 10:16:39 +0000MEDIUM 4.7: A weakness has been identified in ZenTao up to 21.7.6-85642. The impacted element is the function fetchHook of the file module/webhook/model.php of the component Webhook Module. This manipulation causes server-side request forgery. The attack may be initiated remotely. The exploit has been made avaihttps://patchthecve.com/cve/CVE-2025-13789.htmlhttps://patchthecve.com/cve/CVE-2025-13789.htmlSun, 18 Oct 2026 18:10:00 +0000MEDIUM 6.3: A vulnerability was found in ZenTao up to 21.7.6-8564. This affects the function makeRequest of the file module/ai/model.php. The manipulation of the argument Base results in server-side request forgery. The attack can be launched remotely. The exploit has been made public and could be used. Upgradihttps://patchthecve.com/cve/CVE-2025-13787.htmlhttps://patchthecve.com/cve/CVE-2025-13787.htmlSun, 18 Oct 2026 18:10:00 +0000MEDIUM 5.4: A flaw has been found in ZenTao up to 21.7.6-8564. The affected element is the function file::delete of the file module/file/control.php of the component File Handler. Executing manipulation of the argument fileID can lead to improper privilege management. It is possible to launch the attack remotelhttps://patchthecve.com/cve/CVE-2025-5114.htmlhttps://patchthecve.com/cve/CVE-2025-5114.htmlWed, 17 Jun 2026 09:47:13 +0000MEDIUM 6.3: A vulnerability has been found in easysoft zentaopms 21.5_20250307 and classified as critical. This vulnerability affects the function Edit of the file /index.php?m=editor&f=edit&filePath=cGhhcjovLy9ldGMvcGFzc3dk&action=edit of the component Committer. The manipulation of the argument filePath leadshttps://patchthecve.com/cve/CVE-2024-24216.htmlhttps://patchthecve.com/cve/CVE-2024-24216.htmlWed, 17 Jun 2026 07:14:13 +0000CRITICAL 9.8: Zentao v18.0 to v18.10 was discovered to contain a remote code execution (RCE) vulnerability via the checkConnection method of /app/zentao/module/repo/model.php.https://patchthecve.com/cve/CVE-2024-24202.htmlhttps://patchthecve.com/cve/CVE-2024-24202.htmlWed, 17 Jun 2026 07:14:13 +0000CRITICAL 9.8: An arbitrary file upload vulnerability in /upgrade/control.php of ZenTao Community Edition v18.10, ZenTao Biz v8.10, and ZenTao Max v4.10 allows attackers to execute arbitrary code via uploading a crafted .txt file.https://patchthecve.com/cve/CVE-2023-49394.htmlhttps://patchthecve.com/cve/CVE-2023-49394.htmlWed, 17 Jun 2026 06:35:54 +0000MEDIUM 6.1: Zentao versions 4.1.3 and before has a URL redirect vulnerability, which prevents the system from functioning properly.