CVE-2025-13787 is a medium severity improper privilege management flaw (CVSS 5.4) in ZenTao (up to 21.7.6-8564), affecting the file::delete function in module/file/control.php (File Handler), through the fileID argument. Upgrade to ZenTao 21.7.7, which the record says fixes it.
What's affected
The record says ZenTao up to 21.7.6-8564 is affected. The flaw is in the file::delete function in module/file/control.php (File Handler), through the fileID argument. Manipulating that argument leads to improper privilege management, and the attack can be launched remotely.
Affected version: up to 21.7.6-8564. The record says upgrading to version 21.7.7 is sufficient to fix this issue.
The CVSS vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. The attack vector is the network, and the vector lists low privileges required, so an attacker needs some kind of valid account first. The weakness classes are CWE-266, CWE-269.
How to check if you're exposed
Find the installed ZenTao version and compare it with 21.7.6-8564. Use the method in the ZenTao documentation for your edition. The version is normally shown in the administration or about pages of the application, and it is also recorded in the installation directory.
grep -rn "21\.7" /path/to/zentao/config/version 2>/dev/null | head
The path varies by installation, so treat that as a hint, not a rule. If the version is at or below 21.7.6-8564, you are in the affected range. If it is 21.7.7 or newer, the record says the issue is fixed.
Also check who can log in. The CVSS vector for this record requires low privileges, so the first question is how many accounts exist and who owns them.
What to do now
- Confirm the ZenTao version on every instance, including staging.
- Upgrade to 21.7.7 or later. The record says this is sufficient to fix the issue.
- Review the user list and remove or disable accounts that are no longer needed.
- Check audit or application logs for file deletions that you cannot explain, since the flaw concerns deleting files by identifier.
- Make sure you have working backups of the attachments directory, so deleted files can be restored.
- Subscribe to ZenTao release notes so later fixes reach you quickly.
Why it matters
Improper privilege management (CWE-266, CWE-269) means the application lets a user perform an action their role should not allow. The record attributes it to the file delete function and its fileID argument, which points to a low-privilege user being able to act on files beyond their rights.
The impact in the vector is limited to integrity and availability: the attacker can change or remove data but not read it. For a project management tool that holds specifications and attachments, losing files can still hurt, which is why a medium score deserves a patch window instead of a pass.
Quick check
Which version fixes CVE-2025-13787?
The record says upgrading to ZenTao 21.7.7 is sufficient to fix the issue. Confirm against the vendor release notes for your edition before you schedule the change.
Does this expose data to attackers?
The vector lists no confidentiality impact. It lists low integrity and low availability impact, which fits a flaw about deleting files.
Sources
- Gold vulnerability page for CVE-2025-13787
- CVE record for CVE-2025-13787 as published by its CNA, with a published date of 2025-11-30
- Free in-browser dependency scan: gold.safeguard.sh/scan
Last reviewed: 19 October 2026.
