ZendTo Flaw Lets Attackers Bypass Security Controls to Access Sensitive Data

A critical vulnerability in ZendTo, tracked as CVE-2025-34508, allows authenticated users to traverse the system path and access or modify sensitive files belonging to other users. The flaw affects ZendTo versions 6.15-7 and earlier, with a patch released in version 6.15-8 and administrators urged to update immediately to prevent unauthorized access.

The path traversal occurs when the application mishandles two parameters, chunkName and tmp_name, enabling an attacker to move arbitrary server files into a user’s dropoff, revealing contents when the dropoff is downloaded. In a proof-of-concept, using a minimal chunkName and a crafted tmp_name such as /../../log/zendto/zendto.log allowed the server to expose internal identifiers that grant access to all dropoff data.

Beyond data theft, an attacker could target the ZendTo database or core software files, potentially causing a denial-of-service by rendering the service unusable. Administrators who cannot update immediately can mitigate by restricting web server permissions so the web server user cannot read or move files outside the intended directory, and by monitoring server logs for suspicious dropoff activity.