CVE-2025-50857 - Vulnerability Analysis

Overview

ZenTaoPMS v18.11 through v21.6.beta contains a directory traversal vulnerability caused by improper validation in /module/ai/control.php, letting attackers execute arbitrary code via crafted file upload.

Severity & Score

Impact

Attackers can execute arbitrary code remotely, potentially leading to full system compromise.

Mitigation

Update to the latest version of ZenTaoPMS.

References

• https://github.com/sorzs/test/blob/main/read_and_delete
• https://gist.github.com/sorzs/c67a3dcaa9adb49266d5ff52a04d904b

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 28, 2026

🔴 CVE-2025-50857 - Critical (9.8) ZenTaoPMS v18.11 through v21.6.beta is vulnerable to Directory Traversal in /module/ai/control.php. This allows attackers to execute arbitrary code via a crafted file upload 🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-50857/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner