https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-2552.htmlhttps://patchthecve.com/cve/CVE-2026-2552.htmlWed, 17 Jun 2026 10:31:18 +0000MEDIUM 5.5: A vulnerability was identified in ZenTao up to 21.7.8. Affected by this issue is the function delete of the file editor/control.php of the component Committer. Such manipulation of the argument filePath leads to path traversal. Upgrading to version 21.7.9 can resolve this issue. The affected componehttps://patchthecve.com/cve/CVE-2026-2551.htmlhttps://patchthecve.com/cve/CVE-2026-2551.htmlWed, 17 Jun 2026 10:31:17 +0000MEDIUM 5.4: A vulnerability was determined in ZenTao up to 21.7.8. Affected by this vulnerability is the function delete of the file editor/control.php of the component Backup Handler. This manipulation of the argument fileName causes path traversal. It is possible to initiate the attack remotely. The exploit hhttps://patchthecve.com/cve/CVE-2026-1884.htmlhttps://patchthecve.com/cve/CVE-2026-1884.htmlWed, 17 Jun 2026 10:16:39 +0000MEDIUM 4.7: A weakness has been identified in ZenTao up to 21.7.6-85642. The impacted element is the function fetchHook of the file module/webhook/model.php of the component Webhook Module. This manipulation causes server-side request forgery. The attack may be initiated remotely. The exploit has been made avaihttps://patchthecve.com/cve/CVE-2025-13789.htmlhttps://patchthecve.com/cve/CVE-2025-13789.htmlSun, 18 Oct 2026 18:10:00 +0000MEDIUM 6.3: A vulnerability was found in ZenTao up to 21.7.6-8564. This affects the function makeRequest of the file module/ai/model.php. The manipulation of the argument Base results in server-side request forgery. The attack can be launched remotely. The exploit has been made public and could be used. Upgradihttps://patchthecve.com/cve/CVE-2025-13787.htmlhttps://patchthecve.com/cve/CVE-2025-13787.htmlSun, 18 Oct 2026 18:10:00 +0000MEDIUM 5.4: A flaw has been found in ZenTao up to 21.7.6-8564. The affected element is the function file::delete of the file module/file/control.php of the component File Handler. Executing manipulation of the argument fileID can lead to improper privilege management. It is possible to launch the attack remotel