# CVE-2023-38950: ZKTeco BioTime path traversal in iclock API

Source: https://junglewise.ai/threats/cve-2023-38950-zkteco-biotime-path-traversal-in-iclock-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-05-19. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2023-38950 · Severity: critical · CVSS 7.5 · Exploited in the wild · Published 2025-05-19

ZKTeco BioTime is a web-based time and attendance management software used to track employee hours and attendance. A security flaw in this system allows unauthorized individuals to access sensitive files stored on the server without needing a username or password. This could lead to the exposure of configuration files, system credentials, or other private data, and the vulnerability is known to be actively exploited by attackers.

Technologies: [Zkteco BioTime](https://junglewise.ai/threats/technologies/biotime). Vendors: [Zkteco](https://junglewise.ai/threats/vendors/zkteco).

## Quick answers

**Is CVE-2023-38950 exploited in the wild?** Yes. CVE-2023-38950 is known to be exploited in the wild, first recorded on 19 May 2025. Treat it as urgent.

**How severe is CVE-2023-38950?** Critical severity, with a CVSS score of 7.5, published 19 May 2025.

**Which products and versions are affected?** Zkteco BioTime 8.5.5 and versions prior to 9.0.120240617.19506.

**Is there a fix for CVE-2023-38950?** A patch was published on 2024-06-17: Fixed in version 9.0.120240617.19506 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-38950 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2023-38950?** Check whether you run Zkteco BioTime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability (CWE-22) exists in the iclock API component of ZKTeco BioTime. The root cause is improper validation of user-supplied input in API requests, which allows an attacker to use directory traversal sequences (e.g., ../) to escape the intended directory. An unauthenticated, remote attacker can exploit this by sending a specially crafted network request to the iclock API to read arbitrary files on the underlying operating system. This vulnerability has been observed in active exploitation. A fix is available in ZKBioTime version 9.0.120240617.19506.

## Affected products

- ZKTeco BioTime 8.5.5 and versions prior to 9.0.120240617.19506

## Timeline

- 2023-08-03: disclosed: Initial NVD publication
- 2025-05-19: kev added: Added to CISA Known Exploited Vulnerabilities catalog
- 2024-06-17: patched: Fixed in version 9.0.120240617.19506

## Related threats

- [ZKTeco BioTime hard-coded cryptographic key](https://junglewise.ai/threats/cve-2026-108798-a-vulnerability-was-found-in-zkteco-biotime-9-5-6-build-20260130)
- [ZKTeco BioTime authorization bypass in Employee REST API](https://junglewise.ai/threats/cve-2026-108797-a-vulnerability-has-been-found-in-zkteco-biotime-9-5-6-build)
- [ZKTeco BioTime authorization bypass in biometric data endpoint](https://junglewise.ai/threats/cve-2026-108796-a-flaw-has-been-found-in-zkteco-biotime-9-5-6-build-20260130)
- [ZKTeco BioTime improper access control in system settings API](https://junglewise.ai/threats/cve-2026-108795-a-vulnerability-was-detected-in-zkteco-biotime-9-5-6-build)
- [ZKTeco BioTime SQL injection in database migration](https://junglewise.ai/threats/cve-2026-108794-a-security-vulnerability-has-been-detected-in-zkteco-biotime-9-5)