ZKTeco BioTime Path Traversal Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 19/05/2025. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| biotime | < 9.0.1 | 9.0.1 |
A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload. This vulnerability was fixed in version 9.0.120240617.19506 of ZKBioTime.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free