CVE-2025-50857

CRITICAL EPSS 81.1%

Published Feb 26, 20264mo ago · Modified Apr 15, 20262mo ago

9.8 CVSS 3.1

Critical

Published Feb 26, 2026 4mo ago

Last Modified Apr 15, 2026 2mo ago

Description

ZenTaoPMS v18.11 through v21.6.beta is vulnerable to Directory Traversal in /module/ai/control.php. This allows attackers to execute arbitrary code via a crafted file upload

CVSS Details

Base Score

9.8

Exploitability

3.9

Impact

5.9

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality High

Integrity High

Availability High

Threat Intelligence

EPSS Exploit Probability

81.1% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-22 Path Traversal Resource Mgmt

References 2

gist.github.com https://gist.github.com/sorzs/c67a3dcaa9adb49266d5ff52a04d904b
github.com https://github.com/sorzs/test/blob/main/read_and_delete

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.