A flaw in the delete function of ZenTao’s Backup Handler allows manipulation of the fileName argument to traverse directories, which can result in the removal of any file the web process can access. The attack is feasible remotely, and the exposed control.php endpoint accepts fileName as a parameter that is not properly validated. As a result, a compromised web user or attacker able to reach the endpoint could delete configuration files, logs, or other critical resources, potentially leading to data loss or denial of service.

ZenTao versions up to 21.7.8 are affected. The vulnerability resides in the component Backup Handler, specifically the delete method within editor/control.php. Systems running older ZenTao installations or any custom deployments that include this component are at risk until the issue is remediated or the component is removed.

The CVSS score of 5.3 places the flaw in the moderate category, while the EPSS score of less than 1% indicates a very low current exploitation probability. It is not listed in the CISA KEV catalog, and the exploit has been publicly disclosed. The attack vector is remote, requiring only network access to the affected web server, and an attacker can trigger the vulnerability through a crafted HTTP request to the delete endpoint.