CVE-2026-16137CWE-22CWE-434CWE-73path-traversalunrestricted-file-upload

CVE-2026-16137

High · published August 17, 2026

CVSS v3.1
7.2
EPSS
1%
Percentile
54.2
In the wild
Unconfirmed
What it is

In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perform path traversal using resumable upload initiation endpoint, allowing the party to write arbitrary content to any location writable by the application's service account. This may result in the execution of attacker-supplied code.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00743 · 54.2th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-434 · Unrestricted Upload of File with Dangerous Type; CWE-73 · External Control of File Name or Path
Published
2026-08-17T18:20Z
Affected products (1)
ProductVersionsFixed in
progress/sharefile_storage_zones_controller≤ 5.12.5—
References (1)
https://support.sharefile.com/s/article/ShareFile-Storage-Zone-Controller-SZC-Service-Disruption-Guidance-Login-Issues-and-Access-Information · [email protected]
EPSS history
Timeline
  • 17 AUG 13:32Z
    Path traversal via unsanitized upload filename leads to arbitrary file write in Progress ShareFile Storage Zones Controller
    cvelistv5