CVE-2025-34508

CVE-2025-34508 is a path traversal flaw (CWE-22) in the file dropoff functionality of ZendTo, a self-hosted large-file transfer application, affecting versions 6.15-7 and prior. A remote attacker who holds valid credentials can manipulate path parameters in dropoff requests to traverse outside the intended directories. Successful exploitation lets the attacker retrieve files dropped off by other ZendTo users, read files elsewhere on the host system (potentially exposing configuration or credential material), or cause a denial of service. Any organization running ZendTo 6.15-7 or an earlier version is affected, particularly those that expose the web interface to the internet. The flaw is not yet listed in CISA's KEV and no public PoC is known, but the 69.1% EPSS score (99th percentile) indicates a high probability of exploitation attempts within the next 30 days.

What to do: Upgrade ZendTo to the latest release available (any version newer than 7, published after this advisory), as no fixed version is specified in the data. If you run ZendTo, verify your deployed version, restrict dropoff access to trusted authenticated users, and review dropoff/audit logs for anomalous path parameters or unexpected file reads. Until patched, limit internet exposure of the ZendTo interface and avoid using it to transfer sensitive files.