CVE-2026-15724 - Vulnerability Details - OpenCVE

In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated administrative user can exploit a path traversal vulnerability to read arbitrary files from the server filesystem, write files to arbitrary directories, or determine whether specific files exist on the server.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Progress	Sharefile Storage Zones Controller

No data.

No data.

References

Link	Providers
https://support.sharefile.com/s/article/ShareFile-Storage-Zone-Controller-SZC-Service-Disruption-Guidance-Login-Issues-and-Access-Information

History

Wed, 22 Jul 2026 19:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 22 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Progress Progress sharefile Storage Zones Controller
Vendors & Products		Progress Progress sharefile Storage Zones Controller

Tue, 21 Jul 2026 17:00:00 +0000

Type	Values Removed	Values Added
Description		In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated administrative user can exploit a path traversal vulnerability to read arbitrary files from the server filesystem, write files to arbitrary directories, or determine whether specific files exist on the server.
Title		Path traversal in Progress ShareFile Storage Zones Controller (SZC)
Weaknesses		CWE-20 CWE-22 CWE-73
References		https://support.sharefile.com/s/article/ShareFile-Storage-Zone-Controller-SZC-Service-Disruption-Guidance-Login-Issues-and-Access-Information
Metrics		cvssV3_1 `{'score': 8.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N'}`

MITRE

Status: PUBLISHED

Assigner: ProgressSoftware

Published: 2026-07-21T16:55:34.486Z

Updated: 2026-07-24T03:55:48.821Z

Reserved: 2026-07-14T13:13:06.485Z

Link: CVE-2026-15724

Vulnrichment

Updated: 2026-07-22T18:15:14.886Z

NVD

No data.

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-15724", "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "state": "PUBLISHED", "assignerShortName": "ProgressSoftware", "dateReserved": "2026-07-14T13:13:06.485Z", "datePublished": "2026-07-21T16:55:34.486Z", "dateUpdated": "2026-07-24T03:55:48.821Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware", "dateUpdated": "2026-07-21T16:55:34.486Z"}, "title": "Path traversal in Progress ShareFile Storage Zones Controller (SZC)", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}, {"lang": "en", "cweId": "CWE-73", "description": "CWE-73: External Control of File Name or Path", "type": "CWE"}, {"lang": "en", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "An authenticated administrative user can read arbitrary files accessible to the application's service account, write attacker-controlled content to arbitrary directories, or enumerate the server filesystem layout."}]}], "affected": [{"vendor": "Progress", "product": "ShareFile Storage Zones Controller", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "5.12.4", "versionType": "semver"}, {"status": "affected", "version": "6.0.0", "lessThanOrEqual": "6.0.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated administrative user can exploit a path traversal vulnerability to read arbitrary files from the server filesystem, write files to arbitrary directories, or determine whether specific files exist on the server.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated administrative user can exploit a path traversal vulnerability to read arbitrary files from the server filesystem, write files to arbitrary directories, or determine whether specific files exist on the server."}]}], "references": [{"url": "https://support.sharefile.com/s/article/ShareFile-Storage-Zone-Controller-SZC-Service-Disruption-Guidance-Login-Issues-and-Access-Information", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseSeverity": "HIGH", "baseScore": 8.7, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N"}}], "solutions": [{"lang": "en", "value": "Upgrade to ShareFile Storage Zones Controller version 5.12.5 or 6.0.2 or later.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Upgrade to ShareFile Storage Zones Controller version 5.12.5 or 6.0.2 or later."}]}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-23T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-15724"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-24T03:55:48.821Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-15724", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-22T18:15:14.097921Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-22T18:15:14.886Z"}}], "cna": {"title": "Path traversal in Progress ShareFile Storage Zones Controller (SZC)", "source": {"discovery": "INTERNAL"}, "impacts": [{"descriptions": [{"lang": "en", "value": "An authenticated administrative user can read arbitrary files accessible to the application's service account, write attacker-controlled content to arbitrary directories, or enumerate the server filesystem layout."}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Progress", "product": "ShareFile Storage Zones Controller", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.12.4"}, {"status": "affected", "version": "6.0.0", "versionType": "semver", "lessThanOrEqual": "6.0.1"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to ShareFile Storage Zones Controller version 5.12.5 or 6.0.2 or later.", "supportingMedia": [{"type": "text/html", "value": "Upgrade to ShareFile Storage Zones Controller version 5.12.5 or 6.0.2 or later.", "base64": false}]}], "references": [{"url": "https://support.sharefile.com/s/article/ShareFile-Storage-Zone-Controller-SZC-Service-Disruption-Guidance-Login-Issues-and-Access-Information", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated administrative user can exploit a path traversal vulnerability to read arbitrary files from the server filesystem, write files to arbitrary directories, or determine whether specific files exist on the server.", "supportingMedia": [{"type": "text/html", "value": "In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated administrative user can exploit a path traversal vulnerability to read arbitrary files from the server filesystem, write files to arbitrary directories, or determine whether specific files exist on the server.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}, {"lang": "en", "type": "CWE", "cweId": "CWE-73", "description": "CWE-73: External Control of File Name or Path"}, {"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}], "providerMetadata": {"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware", "dateUpdated": "2026-07-21T16:55:34.486Z"}}}, "cveMetadata": {"cveId": "CVE-2026-15724", "state": "PUBLISHED", "dateUpdated": "2026-07-22T18:27:18.360Z", "dateReserved": "2026-07-14T13:13:06.485Z", "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "datePublished": "2026-07-21T16:55:34.486Z", "assignerShortName": "ProgressSoftware"}, "dataVersion": "5.2"}