Progress Software ShareFile Storage Zones Controller: remote code execution

High7.2CVE-2026-16139 · Published Aug 17, 2026 · updated Sep 2, 2026

In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling attacker-controlled files to be written outside the intended preparation directory. This can lead to remote code execution in v5 versions. Remote code execution is not confirmed on v6 versions.