ZendTo Vulnerability Let Attackers Bypass Security Controls and Access Sensitive Data
A critical path traversal vulnerability has been identified in ZendTo, designated as CVE-2025-34508. This flaw affects versions 6.15 to 7 and earlier, allowing authenticated users to manipulate file paths and access sensitive data from the host system.
A critical path traversal vulnerability has been identified in ZendTo, designated as CVE-2025-34508. This flaw affects versions 6.15 to 7 and earlier, allowing authenticated users to manipulate file paths and access sensitive data from the host system.
Path Traversal Vulnerability (CVE-2025-34508)
ZendTo is a PHP-based file sharing service that permits registered users to upload files. During file uploads, two variables, chunkName and tmp_name , are used to manage file staging and transfer. Horizon3.ai reports that the server-side sanitization process removes non-alphanumeric characters from chunkName . However, if an attacker submits a chunkName containing only non-alphanumeric characters, the result is an empty or dot-only string.
This situation results in a chunkPath pointing to the root uploads directory instead of a unique temporary file. Once chunkPath is determined, the code appends a user-controlled tmp_name to relocate the file into the target directory. Since tmp_name is not sanitized, attackers can include directory traversal sequences.
By downloading this file, the application's log data, including dropoff claim IDs, is exposed, enabling enumeration and exfiltration of user-uploaded content or critical system files.
Affected Products ZendTo versions 6.15–7 and earlier
A critical path traversal vulnerability has been identified in ZendTo, designated as CVE-2025-34508.
Impact Arbitrary file read and information disclosure
Exploit Prerequisites Low-privilege authenticated user
CVSS 3.1 Score 7.8 (High)
In default installations, file access is limited to the www-root user's permissions, typically encompassing all uploaded content. Beyond user files, attackers could target the ZendTo database or source code, potentially causing a denial-of-service. Although CVE-2025-34508 requires authentication, the minimal barrier allows low-privilege users to perform arbitrary file reads.
Administrators are advised to upgrade immediately. The fix implements stricter validation on both chunkName and tmp_name to ensure only safe, expected filenames are processed.
Organizations must maintain vigilant patch management and conduct regular security reviews of their file transfer applications.
Based on reporting by Cyber Security News.