The vulnerability exists in ZenTao up to version 21.7.8, affecting the delete function in editor/control.php within the Committer component. By manipulating the filePath parameter, an attacker can traverse the filesystem hierarchy and delete arbitrary files. This flaw falls under CWE‑22 (Path Traversal), potentially compromising the confidentiality, integrity, and availability of files on the server.

Affected instances are installations of ZenTao version 21.7.8 or earlier, including all hosts running that version of the software. The flaw is present in the ZenTao product itself, specifically its editor component used for code commits.

The CVSS base score of 5.1 indicates a medium severity vulnerability, and the EPSS score of less than 1 % suggests a low likelihood of exploitation at the present time. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to exploit the delete endpoint—likely authenticated only if the application enforces access control on the Committer component—allowing them to craft a filePath that points outside the intended directory to delete sensitive or system files.