Vulnerability · Published Aug 17, 2026 · Assigned by ProgressSoftware

CVE-2026-16137Path traversal via unsanitized upload filename leads to arbitrary file write in Progress ShareFile Storage Zones Controller

High 7.2

In plain English

A high-severity path traversal in ShareFile Storage Zones Controller from Progress. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)0.7%top 45.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perform path traversal using resumable upload initiation endpoint, allowing the party to write arbitrary content to any location writable by the application's service account. This may result in the execution of attacker-supplied code.

Affected products (as reported)

Vendor	Product	Versions
Progress	ShareFile Storage Zones Controller	0 – through 5.12.5

Weakness: CWE-22, CWE-73, CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://support.sharefile.com/s/article/ShareFile-Storage-Zone-Controller-SZC-Service-Disruption-Guidance-Login-Issues-and-Access-Information vendor-advisory