CVE-2024-35431

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64. An unauthenticated user can download local files from the server. NOTE: Third parties have indicated other versions are also vulnerable including up to 6.4.1.

• CWE-31

• https://github.com/mrojz/ZKT-Bio-CVSecurity/blob/main/CVE-2024-35431.mdExploit
• https://github.com/mrojz/ZKT-Bio-CVSecurity/blob/main/CVE-2024-35431.mdExploit

Published

May 30, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-35426vmir e8117 was discovered to contain a stack overflow via th…9.8
• CVE-2024-35427vmir e8117 was discovered to contain a segmentation violatio…5.5
• CVE-2024-35428ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Tra…7.1
• CVE-2024-35429ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Tra…6.5
• CVE-2024-3543 Use of reversible password encryption algorithm allows atta…7.5
• CVE-2024-35430In ZKTeco ZKBio CVSecurity v6.1.1_R and earlier (fixed in 6.…8.1
• CVE-2024-35432ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Cross Site Sc…6.1
• CVE-2024-35433ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Incorrect Acc…8.1
• CVE-2024-35434Irontec Sngrep v1.8.1 was discovered to contain a heap buffe…7.5
• CVE-2024-3544 Unauthenticated attackers can perform actions, using SSH pr…7.5
• CVE-2024-3545Improper permission handling in the vault offline cache feat…4.3
• CVE-2024-35451LinkStack 2.7.9 through 4.7.7 allows resources\views\compone…4.8