CVE-2026-15724
Received Received - Intake

Path Traversal in Progress ShareFile Storage Zones Controller

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: Progress Software Corporation

Description
In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated administrative user can exploit a path traversal vulnerability to read arbitrary files from the server filesystem, write files to arbitrary directories, or determine whether specific files exist on the server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-21
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-15724
EUVD
EUVD-2026-46325

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
progress sharefile_storage_zones_controller to 5.12.5 (exc)
progress sharefile_storage_zones_controller to 5.12.5|end_excluding=6.0.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Progress ShareFile Storage Zones Controller versions before 5.12.5 and 6.0.2. An authenticated admin can exploit a path traversal flaw to read arbitrary files, write files to any directory, or check if specific files exist on the server.

Detection Guidance

Detecting this vulnerability requires checking the version of Progress ShareFile Storage Zones Controller. If the version is prior to 5.12.5 or 6.0.2, the system is vulnerable. Use commands like 'curl -s http://[server]/[path]/version' or check the installed version via package manager (e.g., 'dpkg -l | grep sharefile' or 'rpm -qa | grep sharefile').

Additionally, monitor for unusual file access patterns or unauthorized file writes in system logs. Look for administrative user activity that may indicate exploitation attempts.

Impact Analysis

An attacker with admin access could steal sensitive data, modify or delete files, or plant malicious files. This could lead to data breaches, system compromise, or service disruption.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR (data protection) and HIPAA (health information privacy) requirements. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Immediately upgrade Progress ShareFile Storage Zones Controller to version 5.12.5 or 6.0.2 or later. Restrict administrative user access to only necessary functions and enforce least privilege principles.

Review system logs for signs of exploitation. Implement network segmentation to limit exposure of the Storage Zones Controller. Consider disabling the service if not critical.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15724. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart