Skip to content
CVE PROGRAM SOURCE RECORD7.2 High

CVE-2026-16137

Path traversal via unsanitized upload filename leads to arbitrary file write in Progress ShareFile Storage Zones Controller

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
ProgressSoftware

Description

In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perform path traversal using resumable upload initiation endpoint, allowing the party to write arbitrary content to any location writable by the application's service account. This may result in the execution of attacker-supplied code.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Progress ShareFile Storage Zones Controller

Default version status: unaffected

  • 0 to ≤ 5.12.5affected

References