ZendTo Flaw Lets Attackers Bypass Security Controls to Access Sensitive Data

A critical vulnerability has been identified in the ZendTo file-sharing tool, allowing authenticated users to traverse system paths and access or modify sensitive files belonging to other users.

This vulnerability, tracked as CVE-2025-34508, affects ZendTo versions 6.15-7 and earlier. Exploiting this flaw enables an attacker to read server logs, user data, and critical application files. ZendTo has released a patch in version 6.15-8, and it is recommended that administrators update immediately to prevent unauthorized access.

ZendTo is designed to allow users to drop off and pick up large files through a secure web interface. During file uploads, the application uses two key parameters: chunkName and tmp_name .

CVE ID Affected Versions Vulnerability Type Impact Patch Version

CVE-2025-34508 6.15-7 and earlier Path traversal Unauthorized file access and modification 6.15-8

Normally, chunkName is created by client-side scripts and cleaned to allow only letters and numbers. However, if chunkName contains no alphanumeric characters, the code defaults to the base upload directory.

ZendTo then combines tmp_name with the upload directory path without proper sanitization. By using a specially crafted tmp_name , such as /../../log/zendto/zendto.log , an attacker can move arbitrary files from the server into their personal dropoff.

This relocation exposes the contents when the attacker downloads the dropoff package. In default settings, any file accessible by the web server user is at risk, including uploaded files, logs, and configuration data.

A proof of concept demonstrated using a chunkName of . and tmp_name of /../../log/zendto/zendto.log , resulting in the server moving its own log file into the dropoff directory. The attacker could then download the logfile, containing internal identifiers granting access to all other dropoff data. These identifiers allow systematic retrieval of every file uploaded by legitimate users.

Beyond data theft, an attacker could target the ZendTo database or core software files, potentially removing or corrupting these, which would render the service unusable and cause a denial-of-service condition.

ZendTo addressed CVE-2025-34508 in version 6.15-8. Administrators are advised to upgrade without delay.

For those unable to update immediately, a temporary mitigation involves restricting file system permissions so the web server user cannot read or move files outside its intended directory. Monitoring server logs for suspicious dropoff activity is also advised. Application owners should adopt a defense-in-depth approach, ensuring validation and sanitization of user inputs on both client and server sides.

Employ security frameworks that enforce strict path normalization, and regularly review and test file upload and download logic for path traversal and related issues.

Based on reporting by GBHackers.