CVE-2026-16137
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perform path traversal using resumable upload initiation endpoint, allowing the party to write arbitrary content to any location writable by the application's service account. This may result in the execution of attacker-supplied code.
Risk Assessment
An attacker with zone credentials could write malicious files to the server and achieve remote code execution, potentially leading to full system compromise.
Recommendation
Update to a version newer than 5.12.5 and monitor file upload activity.
Original NVD description (English source)
In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perform path traversal using resumable upload initiation endpoint, allowing the party to write arbitrary content to any location writable by the application's service account. This may result in the execution of attacker-supplied code.