CVE-2026-16137

7.2 Élevée

Publiée le 17/08/2026 à 16:20 · Modifiée le 02/09/2026 à 20:44 · Analysée par le NVD · Source : security@progress.com

Description

In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perform path traversal using resumable upload initiation endpoint, allowing the party to write arbitrary content to any location writable by the application's service account. This may result in the execution of attacker-supplied code.

Traduire en français

Produits concernés

Progress ShareFile Storage Zones Controller

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.2 Élevée	security@progress.com	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-22
CWE-73
CWE-434

Références

https://support.sharefile.com/s/article/ShareFile-Storage-Zone-Controller-SZC-Service-Disruption-Guidance-Login-Issues-and-Access-Information Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories