CVEvulnerability

CVE-2026-16139

7.2 HIGH Published 2026-08-17 Modified 2026-09-02 Official page ↗
Status
Analyzed
Published
2026-08-17
Last modified
2026-09-02
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20, CWE-22, CWE-73

Description

In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling attacker-controlled files to be written outside the intended preparation directory. This can lead to remote code execution in v5 versions. Remote code execution is not confirmed on v6 versions.

Affected configurations

• progress sharefile storage zones controller (< 5.12.6) • progress sharefile storage zones controller (>= 6.0 < 6.0.3)

Related

Weakness · CWE (3)

  • CWE-20 Improper Input Validation weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-73 External Control of File Name or Path weakness

References