CVE-2026-16139

7.2 Élevée

Publiée le 17/08/2026 à 16:20 · Modifiée le 02/09/2026 à 20:47 · Analysée par le NVD · Source : security@progress.com

Description

In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling attacker-controlled files to be written outside the intended preparation directory. This can lead to remote code execution in v5 versions. Remote code execution is not confirmed on v6 versions.

Traduire en français

Produits concernés

Progress ShareFile Storage Zones Controller

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.2 Élevée	security@progress.com	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-20
CWE-22
CWE-73

Références

https://support.sharefile.com/s/article/ShareFile-Storage-Zone-Controller-SZC-Service-Disruption-Guidance-Login-Issues-and-Access-Information Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories