CVE-2026-16139
Received Received - Intake

Authenticated File Write Leading to RCE in Progress ShareFile Storage Zones Controller

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: Progress Software Corporation

Description
In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling attacker-controlled files to be written outside the intended preparation directory. This can lead to remote code execution in v5 versions. Remote code execution is not confirmed on v6 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-16139
EUVD
EUVD-2026-60196

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
progress sharefile_storage_zones_controller to 5.12.5 (inc)
progress sharefile_storage_zones_controller to 5.12.5|end_including=6.0.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Progress ShareFile Storage Zones Controller versions 5.12.5 or lower and 6.0.2 or lower. An authenticated zone administrator can exploit improper validation during file downloads to write attacker-controlled files outside the intended directory. This may lead to remote code execution, particularly in version 5.

Impact Analysis

An attacker with zone administrator access could execute arbitrary code on the affected system, potentially gaining full control. This could lead to data theft, system compromise, or further network infiltration. Unauthorized file writes outside intended directories may disrupt operations.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's integrity and confidentiality requirements. For HIPAA, it may compromise protected health information security. Compliance failures could result in legal penalties and reputational damage.

Mitigation Strategies

Upgrade Progress ShareFile Storage Zones Controller to versions above 5.12.5 and 6.0.2 immediately to address the improper validation flaw. Ensure only authorized zone administrators have access to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16139. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart