Critical severity9.8NVD Advisory· Published Feb 8, 2024· Updated Jun 17, 2026

CVE-2024-24202

Description

An arbitrary file upload vulnerability in /upgrade/control.php of ZenTao Community Edition v18.10, ZenTao Biz v8.10, and ZenTao Max v4.10 allows attackers to execute arbitrary code via uploading a crafted .txt file.

Affected products

Easycorp/Zentao
cpe:2.3:a:easycorp:zentao:18.10:*:*:*:community:*:*:*
Easycorp/Zentao Biz
cpe:2.3:a:easycorp:zentao_biz:8.10:*:*:*:*:*:*:*
Easycorp/Zentao Max
cpe:2.3:a:easycorp:zentao_max:4.10:*:*:*:*:*:*:*
Zentao/ZenTao Community Editioncpe-rescue2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: v18.10
Zentao/Zentaollm-fuzzy
Range: v8.10

Patches

Vulnerability mechanics

References

clammy-blizzard-8ef.notion.site/Zentao-PMS-Authorized-Remote-Code-Execution-Vulnerability-1077a870c92848e18fe0c139c4fc2176nvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000