This vulnerability (CVE-2026-15724) involves improper limitation of a pathname to a restricted directory (CWE-22) in Progress ShareFile Storage Zones Controller. Authenticated administrative users can exploit the path traversal flaw to perform unauthorized file read and write operations on the server filesystem, as well as verify file existence. The affected versions include 6.0.0 and versions prior to 5.12.5 and 6.0.2. The CVSS v3.1 score is 8.7, indicating high impact on confidentiality and integrity, with no impact on availability. The vulnerability requires high privileges (administrative user) and no user interaction. No vendor advisory or patch is currently available.

Successful exploitation allows an authenticated administrative user to read sensitive files, write files to arbitrary locations on the server, and determine the presence of files. This compromises confidentiality and integrity of the system. There is no direct impact on availability. The vulnerability could lead to unauthorized disclosure of sensitive data and potential unauthorized modification of server files.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrative access to trusted personnel only and monitor for suspicious activity. Avoid exposing the affected versions in untrusted environments.