Description

In Progress ShareFile Storage Zones Controller v5.12.5 and below versions, unsafe deserialization of untrusted file metadata can allow a user with write access to a Network share to execute arbitrary code on the Storage Zones Controller host.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.0",
  "pubDate": "2026-08-17T14:20:19.797Z",
  "pubdate": "2026-08-17T14:20:19.797Z",
  "executiveSummary": "An unsafe deserialization vulnerability has been identified in ShareFile Storage Zones Controller versions v5.12.5 and below. This security flaw stems from the insecure handling of untrusted file metadata by the application. Successfully exploiting this vulnerability allows an authenticated malicious actor with write access to a designated network share to achieve arbitrary code execution on the underlying Storage Zones Controller host.\nThe risk implication is severe, as compromise of the Storage Zones Controller typically grants deep access into the internal infrastructure, potentially exposing sensitive documents and enterprise data managed by the ShareFile environment. The exploitation process requires the attacker to possess pre-existing write access to a network share monitored or processed by the vulnerable controller, allowing them to supply maliciously crafted file metadata designed to trigger the unsafe deserialization routine upon processing by the application.",
  "technicalDetails": "The vulnerability resides within the ShareFile Storage Zones Controller component in versions v5.12.5 and below. The root cause of the security defect is unsafe deserialization, where the application processes incoming file metadata originating from untrusted sources without proper sanitization, validation, or type constraints.\nThe attack flow begins when an adversary leverages write access to a network share utilized by the Storage Zones Controller. The attacker places or modifies a file within the share, incorporating maliciously crafted serialized objects into the file metadata fields that are subsequently read and processed by the controller.\nWhen the vulnerable component parses the untrusted file metadata, the deserialization mechanism instantiates objects based on the attacker-controlled input streams. By leveraging specially crafted payloads containing gadget chains, the attacker can manipulate the execution flow of the application. This process bypasses standard security boundaries and results in the execution of arbitrary code within the context of the service account running the Storage Zones Controller host.\nAuthentication and privilege requirements include standard write access to the targeted network share. The vulnerability highlights systemic risks associated with handling complex data structures from semi-trusted storage layers without strict deserialization safeguards, such as type whitelisting or secure serialization protocols."
}