ShareFile Storage Zones Controller EUVD-2026-46325

Exploitation requires an authenticated user with administrative privileges on the ShareFile Storage Zones Controller (CVSS PR:H), so it is not usable by anonymous or standard users - the actor must already possess SZC admin access. The vulnerable primitive is the SZC's handling of file path parameters in its storage operations, which fail to constrain traversal; the affected deployment is the on-premises Storage Zones Controller running a version below 5.12.5 or 6.0.2. Limiting factors: the PR:H requirement means credentials or an existing admin session are prerequisite, the network interface must be reachable by the attacker (AV:N), and no user interaction is needed (UI:N). There is no indication of a non-default configuration requirement - any affected on-prem SZC build appears vulnerable once admin access is held.

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) describes a network-reachable, low-complexity attack that nonetheless requires high privileges - the description confirms an 'authenticated administrative user' is the actor, so this is a privilege-abuse / post-compromise escalation issue rather than an unauthenticated internet-facing RCE. The scope change (S:C) plus dual C:H/I:H reflect that admin rights over the application are leveraged into arbitrary host filesystem read AND write, materially more dangerous than the admin role nominally grants. No EPSS score, KEV listing, or POC was provided, so there is no signal of active exploitation or automated weaponization; the realistic threat model is a malicious or compromised SZC administrator, or an attacker who has already obtained admin credentials. This is a genuine priority for organizations running the affected on-prem component because the write primitive can lead to code execution or persistence, but the PR:H gate meaningfully limits mass, opportunistic exploitation. Note the referenced advisory is titled around 'Service Disruption Guidance / Login Issues' rather than this specific path-traversal CVE - verify the exact fix-version-to-advisory mapping with Progress support.

An attacker who has obtained (or already holds) ShareFile Storage Zones Controller administrative credentials sends a crafted request to an SZC file operation, substituting a traversal payload such as '..\..\..\Windows\win.ini' or an absolute path into a path parameter. The controller resolves the path outside its storage root, returning the contents of sensitive host files (configuration, secrets) or writing an attacker-controlled file into a directory that leads to code execution or persistence. No public exploit code has been identified, and the attack presupposes administrative authentication (AV:N/AC:L).