Description
In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling attacker-controlled files to be written outside the intended preparation directory. This can lead to remote code execution in v5 versions. Remote code execution is not confirmed on v6 versions.
Affected products
progress: sharefile storage zones controller
References1
- support.sharefile.com/s/article/ShareFile-Storage-Zone-Controll… Vendor Advisory
Metrics
- CVSS 3.1
-
7.2
HIGH
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 1% percentile: 61 · as of 11 November 2026
- CWE
- CWE-20CWE-22CWE-73
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.