EUVD-2026-60196
GHSA-7pfv-v2m2-p6x4
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Zone administrator authentication required (PR:H); network-exploitable path traversal with confirmed RCE drives C:H/I:H/A:H; scope unchanged as exploitation stays within the SZC boundary.
Primary rating from Vendor (progress).
CVSS VectorVendor: progress
Lifecycle Timeline
2DescriptionCVE.org
In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling attacker-controlled files to be written outside the intended preparation directory. This can lead to remote code execution in v5 versions. Remote code execution is not confirmed on v6 versions.
AnalysisAI
Path traversal in Progress ShareFile Storage Zones Controller (v5 ≤ 5.12.5, v6 ≤ 6.0.2) enables an authenticated zone administrator to write attacker-controlled files outside the intended download preparation directory. On v5 versions this file-write primitive escalates to confirmed remote code execution; the vendor has not confirmed RCE on v6. No public exploit has been identified at time of analysis, though the vulnerability was self-disclosed by Progress via security@progress.com.
Technical ContextAI
Progress ShareFile Storage Zones Controller (SZC) is the on-premises component of the ShareFile enterprise file-sharing platform, responsible for managing the storage zones where files are staged for upload and download. The root cause is CWE-20 (Improper Input Validation) within the download preparation flow - a backend stage where files are temporarily staged before delivery to the requestor. Insufficient sanitization of user-supplied path parameters allows a zone administrator to inject traversal sequences that cause the preparation logic to write files to arbitrary filesystem locations outside the designated staging directory. On v5 branches (≤ 5.12.5), this arbitrary write primitive is leveraged to achieve RCE, likely by placing web shells or executable payloads in locations processed by the SZC web server or underlying OS. No CPE string was provided in the input; affected version ranges are sourced from the vendor advisory.
RemediationAI
Organizations should upgrade Progress ShareFile Storage Zones Controller to a version beyond the affected ranges - above 5.12.5 for v5 branch deployments and above 6.0.2 for v6 branch deployments. No exact fixed version number was present in the available input data; consult the vendor advisory directly at https://support.sharefile.com/s/article/ShareFile-Storage-Zone-Controller-SZC-Service-Disruption-Guidance-Login-Issues-and-Access-Information for specific patched release versions before upgrading. As compensating controls while a patched release is obtained, enforce multi-factor authentication on all zone administrator accounts and audit those accounts for signs of compromise or unauthorized sharing. Restrict network access to the SZC management interface to trusted internal subnets or VPN-gated networks only - this reduces the AV:N attack surface at the cost of limiting remote administration capability. Monitor SZC server filesystem activity for anomalous file writes outside expected staging directories as an additional detection measure.
Unauthenticated remote code execution affects Progress ShareFile Storage Zones Controller versions up to 5.12.3 via unau
A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, coul
Remote code execution in Progress ShareFile Storage Zones Controller versions up to 5.12.3 allows high-privileged authen
Path traversal in Progress ShareFile Storage Zones Controller before 5.12.5 and 6.0.2 lets an authenticated administrati
Unsafe deserialization in Progress ShareFile Storage Zones Controller v5.12.5 and below exposes the controller host to a
Path traversal in Progress ShareFile Storage Zones Controller v5.12.5 and below enables an authenticated party holding v
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today