This vulnerability (CVE-2026-15724) affects Progress ShareFile Storage Zones Controller and involves improper limitation of a pathname to a restricted directory (CWE-22). Authenticated administrative users can exploit this flaw to perform path traversal attacks, enabling them to read, write, or verify files outside intended directories on the server. The affected versions include those prior to 5.12.5 and 6.0.2, specifically including version 6.0.0. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, and high impact on confidentiality and integrity but no impact on availability. There is no vendor advisory or patch link provided, and the remediation level is not specified.

An authenticated administrative user can exploit this vulnerability to access or modify arbitrary files on the server filesystem, potentially leading to unauthorized disclosure or alteration of sensitive data. The vulnerability impacts confidentiality and integrity with high severity but does not affect availability. This could compromise the security of the affected system and data stored within the ShareFile Storage Zones Controller environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, organizations should monitor Progress vendor communications for updates. Until a patch is available, restrict administrative access to trusted personnel only and consider additional monitoring of administrative actions to detect potential exploitation attempts.