1. Home
  2. CVE Database
  3. CVE-2026-16139
HIGH · 7.2

CVE-2026-16139

In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling attacker-...

Vulnerability Description

In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling attacker-controlled files to be written outside the intended preparation directory. This can lead to remote code execution in v5 versions. Remote code execution is not confirmed on v6 versions.

CVSS Score

7.2

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
ProgressSharefile Storage Zones Controller< 5.12.6

Related Weaknesses (CWE)

CWE-73CWE-22CWE-20

References

FAQ

What is CVE-2026-16139?

CVE-2026-16139 is a vulnerability with a CVSS score of 7.2 (HIGH). In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling attacker-...

How severe is CVE-2026-16139?

CVE-2026-16139 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-16139?

Check the references section above for vendor advisories and patch information. Affected products include: Progress Sharefile Storage Zones Controller.