Threat Intelligence Database

In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perform path traversal using resumable upload initiation endpoint, allowing the party to write arbitrary content to any location writable by the application's service account. This may result in the execution of attacker-supplied code.

In Progress ShareFile Storage Zones Controller v5.12.5 and below versions, unsafe deserialization of untrusted file metadata can allow a user with write access to a Network share to execute arbitrary code on the Storage Zones Controller host.

CVE-2026-2701 is a critical vulnerability in Progress ShareFile Storage Zones Controller that allows an authenticated user to upload a malicious file to the server and execute it, resulting in remote code execution. The vulnerability arises from unrestricted upload of files with dangerous types. It has a high CVSS score of 9.1, indicating severe impact on confidentiality, integrity, and availability. No patch or official remediation information is currently provided. The vulnerability affects the product version indicated as '0', with no known exploits in the wild at this time.