CVE-2026-16139
HIGH
NVD
CVSS Score
7.2
Severity
HIGH
Published
Aug 17, 2026
Vendor
unknown
Description
In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling attacker-controlled files to be written outside the intended preparation directory. This can lead to remote code execution in v5 versions. Remote code execution is not confirmed on v6 versions.