EUVD-2025-210240Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach network-exposed ZIE upload endpoint
-
DeliveryUpload web shell into Webroot
-
ExploitServer executes script handler
-
ExecutionRun arbitrary OS commands
-
ImpactCompromise host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Error message sanitization
MITRE ATT&CK
1 technique across 1 tactic: Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires two concrete, attacker-out-of-control preconditions stated in the description: (1) the uploaded file must be written inside the Webroot, and (2) the server must be configured to execute code (active server-side scripting/handler) at that location - without both, command execution does not occur and impact is limited to an unrestricted upload. The supplied CVSS marks PR:N/UI:N (no authentication or user interaction in the vector), but the dependence on a non-default execution configuration is the primary limiting factor and is what drives CISA's SSVC 'Exploitation: none / Automatable: no' assessment. Realistic risk is therefore confined to ZIE 16.0 instances where Webroot code execution is enabled. |
| Impact | Signals here conflict and should temper the headline 9.8. The CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) implies trivial, unauthenticated, network-reachable RCE, but the description itself imposes two material preconditions - the server must be 'configured to execute code' and the file must land inside the Webroot - meaning default or hardened deployments may not be exploitable at all. CISA SSVC reinforces this lower real-world picture: Exploitation=none, Automatable=no, Technical Impact=partial. EPSS is low at 0.34% (26th percentile), there is no KEV listing, and no POC is referenced. Taken together this looks like a high-CVSS-but-conditional issue rather than a mass-exploitation emergency: real risk concentrates on instances where code execution in the Webroot is enabled. Note the AC:L in the supplied vector under-weights the non-default configuration requirement; treat the vendor's 9.8 as a worst-case ceiling. |
| Exploit ScenarioDerived | An attacker reaches the ZIE for Web upload functionality over the network and uploads a script-based web shell into a Webroot directory on a server configured to execute that code. The attacker then requests the uploaded file's URL, causing the application server to execute it and run arbitrary OS commands in the ZIE service context. No public exploit code is identified at time of analysis, and success hinges on the non-default execute-in-Webroot configuration. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 26, 2026
Unrestricted file upload in HCL ZIE for Web (Z and I Emulator) version 16.0 allows remote attackers to upload a web shell that can yield arbitrary command execution on the server, but only when the server is configured to execute uploaded code and the file lands inside the Webroot. The CVSS 3.1 base score is 9.8, yet CISA's SSVC framework rates exploitation as 'none' and not automatable with only partial technical impact, and EPSS sits at just 0.34% (26th percentile). No public exploit is identified at time of analysis and the issue is not listed in CISA KEV.
Earlier versions of this analysis (2)
Unrestricted file upload in HCL Z and I Emulator for Web (ZIE) 16.0 lets remote attackers upload arbitrary files, and where the server is configured to execute code in the webroot, plant a web shell for arbitrary command execution on the host. The CVSS 3.1 base score is 9.8 reflecting an unauthenticated network vector, but successful RCE is gated on a non-default execution configuration. No public exploit identified at time of analysis, and CISA's SSVC rates exploitation as none with low automatability; EPSS is 0.34% (26th percentile).
Unrestricted file upload in HCL ZIE for Web enables authenticated remote attackers to potentially achieve server-side code execution by uploading a web shell, under specific server configuration conditions. The vulnerability affects all versions of HCL ZIE per CPE data (cpe:2.3:a:hcl_software:zie:*:*:*:*:*:*:*:*) and is exploitable by a low-privileged network user. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the vendor has published an advisory at KB0131549.
RemediationAI
Patch available per vendor advisory: consult HCL knowledge-base article KB0131549 (https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131549) for the fixed release and upgrade ZIE 16.0 accordingly - no exact fix version was provided in this data set, so confirm it directly with HCL before scheduling. Because exploitation requires the server to be configured to execute code in the Webroot, the strongest compensating control is to disable server-side execution of uploaded/script content in the web and application server (e.g., remove handler mappings or execute permissions for the upload directory), which neutralizes the web-shell path at the cost of breaking any legitimate dynamic content served from that location. Additionally, restrict or authenticate access to the file-upload endpoint, store uploads outside the Webroot, and enforce server-side allow-list validation of file types; monitor the upload directory for newly created executable/script files. These controls reduce exposure but are not a substitute for the vendor fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
HCL ZIE (Z and I Emulator) for Web is a browser-delivered 3270/5250 terminal emulator used to reach IBM mainframe and IBM i (AS/400) hosts; it descends from the former IBM Host On-Demand product line and typically runs on a Java application server. The affected component is the server-side file upload handler, identified by CPE cpe:2.3:a:hcl_software:zie. The vendor-assigned weakness is CWE-209 (Generation of Error Message Containing Sensitive Information), but this does not match the described behavior - an unrestricted upload of executable content maps far more naturally to CWE-434 (Unrestricted Upload of File with Dangerous Type). The root cause is that the upload routine does not validate or constrain the type/location of uploaded files, so an attacker-controlled file (a web shell) placed in a directory the web/application server will interpret can be executed on request.
Know when Zie gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable upload (AV:N, PR:N) but RCE depends on a non-default execute-in-Webroot configuration outside the attacker's control, so AC:H; full host compromise gives C:H/I:H/A:H.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability, If the server is configured to execute code, then it may be possible to obtain command execution on the server by uploading a file known as a web shell, which allows you to execute arbitrary code or operating system commands. For this attack to be successful, the file needs to be uploaded inside the Webroot, and the server must be configured to execute the code
Executive ViewAI
HCL ZIE for Web v16.0 contains a critical remote code execution vulnerability (CVE-2025-59872, CVSS 9.8) via unrestricted file upload. No public exploit identified at time of analysis. Real-world risk is mitigated by configuration requirements (server must execute uploaded code) and low exploitation probability (0.3% EPSS), but organizations with internet-exposed instances running this version should prioritize mitigation immediately.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable or restrict file upload capabilities if operationally feasible; (2) Reconfigure application servers to prevent execution of uploaded files; (3) Restrict write permissions in webroot directories; (4) Implement web application firewall (WAF) rules to block suspicious uploads; (5) Apply network segmentation to limit internet exposure; (6) Enable logging and monitoring on upload endpoints for suspicious activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
GitHub PoC
Exploit-DB