CVE-2026-16139 - Exploits & Severity

In Progress ShareFile Storage Zones Controller versions 5.12.5 and earlier, and 6.0.2 and earlier, an authenticated zone administrator can exploit improper validation in the download preparation flow to write attacker-controlled files outside the intended preparation directory. This can lead to remote code execution in v5 versions, though remote code execution is not confirmed on v6 versions.

An authenticated zone administrator can write arbitrary files outside the intended preparation directory, leading to remote code execution on v5 versions of ShareFile Storage Zones Controller.

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch information not provided in the vulnerability data.

Upgrade Progress ShareFile Storage Zones Controller to a version newer than 5.12.5 (for v5 line) and 6.0.2 (for v6 line). Restrict zone administrator privileges to trusted users only. Monitor file system activity for unexpected file writes outside preparation directories.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

NVD published the first details for CVE-2026-16139

Feedly found the first article mentioning CVE-2026-16139 . See article

GitHub Advisories released a security advisory .

[GHSA-7pfv-v2m2-p6x4] In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2,

[GHSA-7pfv-v2m2-p6x4] In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2,

CVE-2026-16139 | Progress ShareFile Storage Zones Controller up to 5.12.5/6.0.2 path traversal

CVE-2026-16139: Arbitrary file write via path traversal in Progress ShareFile Storage Zones Controller potentially leading to remote code execution [HIGH] CVSS 7.2

Collect, analyze, and vulnerability reports faster using AI