Vulnerability · Published Aug 17, 2026 · Assigned by ProgressSoftware

CVE-2026-16139Arbitrary file write via path traversal in Progress ShareFile Storage Zones Controller potentially leading to remote code execution

High 7.2

In plain English

A high-severity path traversal in ShareFile Storage Zones Controller from Progress. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)0.9%top 39.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling attacker-controlled files to be written outside the intended preparation directory. This can lead to remote code execution in v5 versions. Remote code execution is not confirmed on v6 versions.

Affected products (as reported)

Vendor	Product	Versions
Progress	ShareFile Storage Zones Controller	0 – through 5.12.56.0.0 – through 6.0.2

Weakness: CWE-22, CWE-73, CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://support.sharefile.com/s/article/ShareFile-Storage-Zone-Controller-SZC-Service-Disruption-Guidance-Login-Issues-and-Access-Information vendor-advisory