CVE-2025-59872 describes an unrestricted file upload vulnerability in HCL Software's ZIE product, version 16.0. An attacker with the ability to upload files to the webroot could upload a web shell, potentially leading to arbitrary code execution if the server executes uploaded files. The vulnerability is linked to CWE-209, which involves generation of error messages containing sensitive information. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, low confidentiality impact, and no integrity or availability impact. No vendor advisory or patch information is currently provided.

Successful exploitation could allow an attacker to execute arbitrary code or operating system commands on the affected server, but only if the server is configured to execute uploaded files within the webroot. Confidentiality impact is low due to potential sensitive information leakage in error messages. There is no reported impact on integrity or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should ensure that file upload functionality is properly restricted and that the server is not configured to execute uploaded files in the webroot. Additionally, review error message handling to avoid leaking sensitive information. Monitor vendor communications for updates.