Description

In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling attacker-controlled files to be written outside the intended preparation directory. This can lead to remote code execution in v5 versions. Remote code execution is not confirmed on v6 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-17T14:20:19.913Z",
  "pubdate": "2026-08-17T14:20:19.913Z",
  "executiveSummary": "An improper validation vulnerability exists in Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2.\nThe vulnerability allows an authenticated zone administrator to exploit the download preparation flow, enabling attacker-controlled files to be written outside the intended preparation directory.\nThe security impact includes remote code execution (RCE) on version 5 implementations, whereas remote code execution is currently not confirmed on version 6 implementations.\nThis vulnerability introduces significant risk to organizational infrastructure by allowing administrative privilege escalation to execute arbitrary code on the underlying host operating system.\nSuccessful exploitation requires authenticated access with zone administrator privileges and leverages improper input validation within the specific file download preparation subsystem.\nOrganizations utilizing the affected software must apply the latest vendor patches to remediate the improper validation flaw and prevent unauthorized file write operations.",
  "technicalDetails": "The vulnerability resides within the download preparation flow of the Progress ShareFile Storage Zones Controller, specifically affecting versions <= 5.12.5 and <= 6.0.2.\nThe root cause of the issue is improper validation of input parameters within the download preparation workflow, which fails to adequately sanitize file paths and enforce strict boundary checks against directory traversal sequences.\nExploitation requires an authenticated attacker possessing zone administrator privileges to interact with the vulnerable component.\nThe attack flow initiates when the authenticated zone administrator submits a maliciously crafted request to the download preparation mechanism containing path traversal sequences.\nDue to the absence of rigorous validation, the application processes the attacker-controlled input and allows files to be written outside the intended preparation directory to arbitrary locations on the filesystem.\nIn version 5 environments, this arbitrary file write capability can be leveraged to achieve remote code execution (RCE) by overwriting application binaries, configuration files, or executing scripts within web-accessible or execution-prone directories.\nIn version 6 environments, while arbitrary file write is confirmed via the same underlying path validation flaw, remote code execution has not been confirmed, though the potential for unauthorized filesystem modification remains high.\nThe vulnerable component is exposed via the network interfaces used by the ShareFile Storage Zones Controller, demanding valid administrative authentication credentials as a pre-requisite for initiating the exploitation sequence.\nPost-exploitation impact varies by version, ranging from unauthorized file modification and system integrity compromise in version 6 to full remote code execution and system takeover in version 5."
}