CVE-2026-16139 — Arbitrary file write via path traversal in Progress ShareFile Storage Zones Controller potentially leading to remote code execution
In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation f…
Published: 2026-08-17 · CVSS: 7.2 · CVSS 3.1
In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling attacker-controlled files to be written outside the intended preparation directory. This can lead to remote code execution in v5 versions. Remote code execution is not confirmed on v6 versions.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7