CVE-2026-16137 is a path traversal vulnerability in In Progress ShareFile Storage Zones Controller versions 5.12.5 and below. An attacker with valid zone credentials can exploit the resumable upload initiation endpoint to write arbitrary files to any location accessible by the application's service account. This can result in arbitrary code execution. The vulnerability is identified by CWE-22 (Path Traversal). The CVSS v3.1 base score is 7.2, indicating high severity with network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with valid zone credentials can write arbitrary content to any location writable by the application's service account, potentially leading to execution of malicious code. This compromises confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict access to valid zone credentials and monitor for suspicious activity related to the resumable upload initiation endpoint.