CVE-2026-16139 — Arbitrary file write via path traversal in Progress ShareFile Storage Zones Controller potentially leading to remote…

CVE-2026-16139

Arbitrary file write via path traversal in Progress ShareFile Storage Zones Controller potentially leading to remote code execution PUBLISHED

Description (CNA)

In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling attacker-controlled files to be written outside the intended preparation directory. This can lead to remote code execution in v5 versions. Remote code execution is not confirmed on v6 versions.

Affected (CNA)

Vendor / product	Versions
Progress / ShareFile Storage Zones Controller	affected 0 through 5.12.5; affected 6.0.0 through 6.0.2

CWE

CWE-22, CWE-73, CWE-20

References

https://support.sharefile.com/s/article/ShareFile-Storage-Zone-Controller-SZC-Service-Disruption-Guidance-Login-Issues-and-Access-Information

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.