CVE-2024-35431: ZKTeco Zkbio Cvsecurity

High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days.

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64. An unauthenticated user can download local files from the server. NOTE: Third parties have indicated other versions are also vulnerable including up to 6.4.1.

Affected products

• ZKTeco Zkbio Cvsecurity: version 6.1.1 only

Published 2024-05-30. Last modified 2026-06-17.