A high-severity zero-day path traversal vulnerability was discovered in Progress ShareFile Storage Zone Controllers affecting all 5.x and 6.x versions. This vulnerability allows an authenticated administrative user to read arbitrary files accessible to the application's service account, write attacker-controlled content to arbitrary directories, and enumerate the server filesystem layout. Due to the severity, Progress temporarily disabled access to ShareFile accounts using Storage Zone Controllers and urged customers to shut down their Windows servers. Security updates have been released in versions 5.12.5 and 6.0.2 to address the flaw. Progress reports no evidence of active exploitation or data breaches. The CVE identifier is reserved and will be published in two weeks.

The vulnerability allows an authenticated administrative user to perform unauthorized file read and write operations and to enumerate the filesystem on ShareFile Storage Zone Controllers. This could lead to data exposure or manipulation on the affected on-premises servers. Although no active exploitation or breaches have been identified, the potential for data theft or extortion exists given the role of Storage Zone Controllers in storing transferred files.

Progress has released security updates in ShareFile Storage Zone Controller versions 5.12.5 and 6.0.2 that patch the vulnerability. Customers should immediately apply these updates before bringing Storage Zone Controllers back online. Until patched, Progress recommended shutting down affected Windows servers to prevent potential exploitation. There is currently no indication of active threats or breaches. The CVE will be published in two weeks; meanwhile, follow vendor guidance for updates.