Path Traversal in Progress Sharefile Storage Zones Controller
CVE-2026-16139
In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling attacker-controlled files to be written outside the intended preparation directory. This can lead to remote code execution in v5 versions. Remote code execution is not confirmed on v6 versions.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.009 (59.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 59th percentile — 59.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.007 · newest: 0.009 · change: +0.003
Affected products
Weakness classification (CWE)
References
- support.sharefile.com/s/article/ShareFile-Storage-Zone-Controller-SZC-Service-D… (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-16139?
- CVE-2026-16139 is a high-severity vulnerability in Progress Sharefile Storage Zones Controller, classified under Improper Input Validation. CVSS score: 7.2/10. Published 2026-08-17.
- How severe is CVE-2026-16139?
- High severity. CVSS v3 base score is 7.2 out of 10.