CVE-2026-16139CWE-20CWE-22CWE-73path-traversal

CVE-2026-16139

High · published August 17, 2026

CVSS v3.1
7.2
EPSS
1%
Percentile
60.4
In the wild
Unconfirmed
What it is

In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling attacker-controlled files to be written outside the intended preparation directory. This can lead to remote code execution in v5 versions. Remote code execution is not confirmed on v6 versions.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00935 · 60.4th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-73 · External Control of File Name or Path
Published
2026-08-17T18:20Z
Affected products (2)
ProductVersionsFixed in
progress/sharefile_storage_zones_controller< 5.12.65.12.6
progress/sharefile_storage_zones_controller≥ 6.0, < 6.0.36.0.3
References (1)
https://support.sharefile.com/s/article/ShareFile-Storage-Zone-Controller-SZC-Service-Disruption-Guidance-Login-Issues-and-Access-Information · [email protected]
EPSS history
Timeline
  • 17 AUG 13:31Z
    Arbitrary file write via path traversal in Progress ShareFile Storage Zones Controller potentially leading to remote code execution
    cvelistv5