CVE-2026-2552 | ZenTao up to 21.7.8 Editor editor/control.php delete filePath path traversal

A vulnerability labeled as critical has been found in ZenTao up to 21.7.8. Affected by this issue is the function delete of the file editor/control.php of the component Committer. Such manipulation of the argument filePath leads to path traversal.

This vulnerability is referenced as CVE-2026-2552. The attack needs to be initiated within the local network. No exploit is available.

The affected component should be upgraded.