VULNERABILITY INTELLIGENCE

CVE-2026-16139

CVSS score7.2 HIGH
EPSS probability0.94%
CISA KEVNot currently listed
Published2026-08-17
Last modified2026-09-02
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling attacker-controlled files to be written outside the intended preparation directory. This can lead to remote code execution in v5 versions. Remote code execution is not confirmed on v6 versions.

Weakness classification

  • security@progress.com: CWE-20

Primary references