Overview
CVE-2025-13787 is a medium severity vulnerability affecting ZenTao project management software, specifically versions up to 21.7.6-8564. This flaw allows remote attackers to potentially delete arbitrary files due to improper privilege management in the file deletion functionality. Successful exploitation of this vulnerability could lead to data loss and disruption of project workflows. Immediate action is recommended to mitigate this risk.
Technical Details
The vulnerability resides within the file::delete function located in the module/file/control.php file of the ZenTao application. The issue stems from insufficient validation of the fileID argument when attempting to delete a file. A malicious actor could manipulate this parameter to target files they should not have permission to access, leading to unauthorized deletion. The attack can be launched remotely without requiring prior authentication, making it particularly dangerous.
CVSS Analysis
- CVE ID: CVE-2025-13787
- Severity: MEDIUM
- CVSS Score: 5.4
A CVSS score of 5.4 indicates a medium severity vulnerability. While not critical, it still poses a significant risk and requires prompt attention. The vector is likely Network (AV:N), meaning it’s remotely exploitable, with low attack complexity and requires no privileges (PR:N) or user interaction (UI:N). The scope is unchanged (S:U) and has a moderate impact on confidentiality (C:N), integrity (I:L) and availability (A:L).
Possible Impact
Exploitation of CVE-2025-13787 could have the following consequences:
- Data Loss: Unauthorized deletion of project files, potentially including documents, images, and other essential assets.
- Project Disruption: Loss of critical files can severely impact project timelines and workflows.
- Reputational Damage: Security breaches can erode trust and damage the reputation of the organization using the vulnerable software.
Mitigation and Patch Steps
The vulnerability is addressed in ZenTao version 21.7.7. It is strongly recommended to upgrade to this version as soon as possible.
- Upgrade ZenTao: The most effective solution is to upgrade your ZenTao installation to version 21.7.7 or later. You can download the latest version from the official ZenTao website.
- Verify Upgrade: After upgrading, ensure that the vulnerability is no longer present by testing the file deletion functionality with various
fileIDvalues, taking care not to delete legitimate files.
Always back up your ZenTao installation before performing any upgrades or modifications.
