Read the docs
TI-2021-22301 Aliases CVE-2021-47667GHSA-r4mc-p68x-wx22

OS command injection in ZendTo

Priority HIGH 82CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

An OS command injection vulnerability in lib/NSSDropoff.php in ZendTo 5.24-3 through 6.x before 6.10-7 allows unauthenticated remote attackers to execute arbitrary commands via shell metacharacters in the tmp_name parameter when dropping off a file via a POST /dropoff request.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.36363 98th percentileScored 2026-11-07
Fix Fixed ZendTo (Zend): 6.10-7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ZendZendTo5.24-3 to before 6.10-76.10-7Patch availableCNA
  • ZendTo VendorZend Affected 5.24-3 to before 6.10-7 Fixed in 6.10-7 Patch available CNA

Remediation

  • Fix · CNA ZendTo (Zend) Fixed in 6.10-7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-47667
  2. 2026-10-03 Alias added: GHSA-r4mc-p68x-wx22

References

Other 1

  • TI-2021-02150 Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a… CVSS 3.1CRITICAL 9.8
  • TI-2012-02894 Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not… CVSS 3.1CRITICAL 9.1
  • TI-2016-08119 The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11… CVSS 3.0CRITICAL 9.8
  • TI-2025-23435 Type confusion in ZendTo CVSS 3.1MEDIUM 4.8
  • TI-2020-17638 An issue found in Zend Framework v.3.1.3 and before allow a remote attacker to execute… CVSS 3.1CRITICAL 9.8
  • TI-2016-04204 The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before… CVSS 3.0CRITICAL 9.8
See all 47 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences