CVE-2025-5114 is a medium severity (CVSS 6.3) deserialization flaw in the ZenTao project management system, build 21.5_20250307. The record says the filePath argument of the editor's edit function can be attacked remotely. No fixed version is confirmed, so check the vendor.
What's affected
easysoft zentaopms 21.5_20250307, per the record, which NVD lists under the EasyCorp ZenTao product name. The record places the flaw in the Edit function of the editor module, in a component it calls Committer, reached through an index.php request that carries a filePath value.
The vector lists a low privilege account as the access needed, so an attacker needs a login. The record says the vendor was contacted early and did not respond, and it names no fixed release. I could not confirm a patch, so read the ZenTao release notes before you decide.
A public write-up is referenced. Its address refers to a Phar bypass, which points at PHP archive handling as the mechanism, but I did not fetch it and do not describe more than the record does.
How to check if you're exposed
Find your ZenTao version in the admin area, usually in the footer or the about page. Compare it with the version above. Also check whether the web editor module is enabled and who has accounts that can use it.
On the server, confirm the build:
grep -rn "version" /path/to/zentao/config/config.php | head
Adjust the path for your install. Then look at access logs for requests to the editor with a filePath value that points somewhere unexpected. You can also run the free in-browser dependency scan at gold.safeguard.sh/scan, which checks the packages your own projects use against the Gold directory. It will not find a commercial product installed on a server, so pair it with an inventory of what runs where.
What to do now
- Find every ZenTao install and its version, including test servers.
- Check the vendor's release notes for a fix and update to the newest supported release.
- Restrict the application to your network or VPN, and remove accounts that are no longer used.
- Limit which roles can reach the editor feature, if your edition allows it.
- Watch the logs for odd editor requests, and review the web root for files you did not put there.
Why it matters
The record lists CWE-20 (Improper Input Validation), CWE-502 (Deserialization of Untrusted Data). Deserialization turns stored or transmitted data back into live objects. If the data comes from a user and the application does not restrict what it will rebuild, the user can influence which code runs along the way. In PHP this class of flaw often involves file handling features that trigger the process indirectly.
The score is medium because the attack needs a login, and the vector rates the impact as limited. Medium does not mean ignorable for a tool that stores project plans, bug reports and source references. Treat it as a patch priority for any instance reachable from outside.
The record says the exploit has been disclosed publicly. It does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a fixed version of ZenTao for this CVE?
I could not confirm one. The record lists no fixed version and the vendor did not respond to the researcher per the record. Check the ZenTao release notes.
Does an attacker need an account?
The CVSS vector lists a low privilege account as required, so yes, a valid login is expected. That is why the score is medium.
Sources
Last reviewed: 18 October 2026.
