ZendTo versions 6.15-7 and earlier contain a path traversal vulnerability in the file dropoff functionality. This flaw allows a remote, authenticated attacker to access files belonging to other ZendTo users, access arbitrary files on the host system, or cause a denial of service condition.