Description

In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perform path traversal using resumable upload initiation endpoint, allowing the party to write arbitrary content to any location writable by the application's service account. This may result in the execution of attacker-supplied code.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-17T14:20:19.670Z",
  "pubdate": "2026-08-17T14:20:19.670Z",
  "executiveSummary": "ShareFile Storage Zones Controller version 5.12.5 and below contains a path traversal vulnerability residing in the resumable upload initiation endpoint. The vulnerability allows an authenticated attacker with valid zone credentials to bypass path sanitization controls and write arbitrary files to any location accessible to the application's service account. Successful exploitation of this flaw can lead to the execution of attacker-supplied code, compromising the integrity and availability of the underlying host operating system. The risk implication is severe, as arbitrary file write primitives within service account contexts frequently escalate to full remote code execution. Attack prerequisites require the acquisition and use of valid zone credentials to interact directly with the vulnerable resumable upload initiation endpoint. Defending against this vulnerability necessitates applying official vendor patches or updating to non-vulnerable software releases as soon as they become available.",
  "technicalDetails": "The vulnerability exists within the resumable upload initiation endpoint of ShareFile Storage Zones Controller version 5.12.5 and below. The root cause stems from insufficient input validation and sanitization of user-supplied file paths or parameters processed during the initiation phase of resumable file uploads. Attackers possessing valid zone credentials can manipulate these parameters to include directory traversal sequences such as dot-dot-slash sequences. By leveraging the resumable upload initiation endpoint, an adversary can traverse outside the intended storage zone directory structure and target arbitrary file system locations. The vulnerable component processes the incoming requests and permits the application's service account to write arbitrary content to the designated destination path. Because the file write operation is executed under the security context of the application's service account, any directory or file location writable by that account becomes a viable target for manipulation. Exploitation occurs step-by-step as follows: first, the attacker authenticates using valid zone credentials to gain authorized access to the API endpoints. Second, the attacker crafts a malicious HTTP request directed at the resumable upload initiation endpoint, injecting path traversal sequences into the upload parameters. Third, the application fails to validate the target path properly, accepting the traversal sequences and initializing a resumable upload session that maps to an arbitrary file system location. Fourth, the attacker streams arbitrary payload data to the endpoint, resulting in the creation or overwriting of files outside the intended storage boundaries. Depending on the targeted file path, post-exploitation impact includes overwriting critical application binaries, configuration files, or system scripts, ultimately resulting in the execution of attacker-supplied code."
}