Medium severity5.5NVD Advisory· Published Feb 16, 2026· Updated Jun 17, 2026

CVE-2026-2552

Description

A vulnerability was identified in ZenTao up to 21.7.8. Affected by this issue is the function delete of the file editor/control.php of the component Committer. Such manipulation of the argument filePath leads to path traversal. Upgrading to version 21.7.9 can resolve this issue. The affected component should be upgraded.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Zentao/Zentao3 versions
cpe:2.3:a:zentao:zentao:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:zentao:zentao:*:*:*:*:*:*:*:*range: <=21.7.8
- (no CPE)
- (no CPE)range: <=21.7.8
Zentao/Committerllm-create
Range: <=21.7.8

Patches

Vulnerability mechanics

References

github.com/ez-lbz/ez-lbz.github.io/issues/11nvdExploitIssue Tracking
github.com/ez-lbz/ez-lbz.github.io/issues/11nvdExploitIssue Tracking
vuldb.comnvdThird Party AdvisoryVDB Entry
vuldb.comnvdThird Party AdvisoryVDB Entry
vuldb.comnvdPermissions RequiredVDB Entry

News mentions

No linked articles in our index yet.

cvss	0.358
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000