CVE-2025-59872 describes an unrestricted file upload vulnerability in HCL Software ZIE version 16.0. The vulnerability allows an attacker with at least low privileges to upload a file, such as a web shell, into the webroot directory. If the server is configured to execute code from uploaded files, this can lead to arbitrary code execution or operating system command execution. The vulnerability is associated with CWE-209, which involves generation of error messages containing sensitive information. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, low confidentiality impact, and no integrity or availability impact.

Successful exploitation could allow an attacker to execute arbitrary code or operating system commands on the affected server if it is configured to execute uploaded files within the webroot. Confidentiality impact is low due to potential sensitive information disclosure via error messages (CWE-209). Integrity and availability impacts are not indicated. The vulnerability requires the attacker to have privileges to upload files and the server to be configured to execute code from the uploaded files.

No official patch or remediation is currently available or confirmed by the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, administrators should ensure that the server is not configured to execute code from uploaded files in the webroot and implement strict file upload validation and restrictions to prevent uploading of executable files.