CVE-2026-16139
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling attacker-controlled files to be written outside the intended preparation directory. This can lead to remote code execution in v5 versions; RCE is not confirmed on v6.
Risk Assessment
An attacker with zone administrator privileges could achieve remote code execution on the server, potentially leading to full system compromise.
Recommendation
Update to the latest available version and restrict zone administrator privileges.
Original NVD description (English source)
In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling attacker-controlled files to be written outside the intended preparation directory. This can lead to remote code execution in v5 versions. Remote code execution is not confirmed on v6 versions.