CVE-2026-15724
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Vulnerability in Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2. An authenticated administrative user can exploit a path traversal vulnerability to read arbitrary files, write files to arbitrary directories, or determine whether specific files exist on the server.
Risk Assessment
Risk involves reading sensitive files, writing malicious files, or reconnaissance of the filesystem by an authenticated administrator, potentially leading to privilege escalation or further attacks.
Recommendation
Immediately update Progress ShareFile Storage Zones Controller to version 5.12.5 or 6.0.2.
Other vulnerabilities in Progress ShareFile Storage Zones Controller
See all- CVE-2026-16139High
In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling attacker-controlled files to be written outside the intended preparation directory. This can lead to remote code execution in v5 versions; RCE is not confirmed on v6.
- CVE-2026-16138High
In Progress ShareFile Storage Zones Controller v5.12.5 and below, unsafe deserialization of untrusted file metadata can allow a user with write access to a Network share to execute arbitrary code on the Storage Zones Controller host.
- CVE-2026-16137High
In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perform path traversal using resumable upload initiation endpoint, allowing the party to write arbitrary content to any location writable by the application's service account. This may result in the execution of attacker-supplied code.
Original NVD description (English source)
In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated administrative user can exploit a path traversal vulnerability to read arbitrary files from the server filesystem, write files to arbitrary directories, or determine whether specific files exist on the server.