CVE-2026-16137
Received Received - Intake

Path Traversal in Progress ShareFile Storage Zones Controller

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: Progress Software Corporation

Description
In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perform path traversal using resumable upload initiation endpoint, allowing the party to write arbitrary content to any location writable by the application's service account. This may result in the execution of attacker-supplied code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-16137
EUVD
EUVD-2026-60198

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
progress sharefile_storage_zones_controller to 5.12.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in Progress ShareFile Storage Zones Controller version 5.12.5 and earlier. It allows an attacker with valid zone credentials to perform path traversal via the resumable upload initiation endpoint. This enables writing arbitrary files to any location accessible by the application's service account, potentially leading to code execution.

Impact Analysis

An attacker could exploit this to write malicious files to critical system locations, leading to remote code execution. This could allow full control over the affected system, data theft, or disruption of services.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's security rules. Organizations may face fines or penalties for failing to protect sensitive data.

Mitigation Strategies

Upgrade Progress ShareFile Storage Zones Controller to a version higher than v5.12.5 to address the path traversal vulnerability. Ensure the application's service account has restricted write permissions to prevent arbitrary file writes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16137. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart