Description
In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perform path traversal using resumable upload initiation endpoint, allowing the party to write arbitrary content to any location writable by the application's service account. This may result in the execution of attacker-supplied code.
Affected products
progress: sharefile storage zones controller
References1
- support.sharefile.com/s/article/ShareFile-Storage-Zone-Controll… Vendor Advisory
Metrics
- CVSS 3.1
-
7.2
HIGH
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 1% percentile: 55 · as of 11 November 2026
- CWE
- CWE-22CWE-73CWE-434
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.