Description
zdh_web is a data collection, processing, monitoring, scheduling, and management platform. In zdh_web thru 5.6.17, insufficient validation of file upload paths in the application allows an authenticated user to write arbitrary files to the server file system, potentially overwriting existing files and leading to privilege escalation or remote code execution.
Affected products
zhaoyachao: zdh web
References4
- github.com/zhaoyachao/zdh_web/issues/40 Issue TrackingVendor Advisory
- github.com/zhaoyachao/zdh_web/commit/b2423378a8bf83f159f19ce4e1… Patch
- github.com/zhaoyachao/zdh_web/pull/39 Patch
- github.com/zhaoyachao/zdh_web Product
Metrics
- CVSS 3.1
-
8.8
HIGH
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 1% percentile: 57 · as of 11 November 2026
- CWE
- CWE-22CWE-434
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.