CVE-2026-15724: ShareFile Storage Zones Path Traversal

CVE-2026-15724 Overview

CVE-2026-15724 is a path traversal vulnerability [CWE-20] affecting Progress ShareFile Storage Zones Controller (SZC) versions prior to 5.12.5 and 6.0.2. An authenticated administrative user can traverse directories to read arbitrary files from the server filesystem, write files to arbitrary directories, or determine whether specific files exist on disk. The flaw carries a CVSS 3.1 base score of 8.7 and requires network access with high privileges but no user interaction. Exploitation impacts confidentiality and integrity across a changed security scope. No public exploit or in-the-wild activity has been reported at the time of publication.

Critical Impact
An authenticated administrator can read, write, and probe files anywhere on the Storage Zones Controller host, enabling data theft, configuration tampering, and follow-on code execution paths.

Affected Products

Progress ShareFile Storage Zones Controller versions prior to 5.12.5
Progress ShareFile Storage Zones Controller versions prior to 6.0.2
Deployments hosting on-premises ShareFile storage zones

Discovery Timeline

2026-07-21 - CVE-2026-15724 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-15724

Vulnerability Analysis

The vulnerability resides in file-handling routines exposed to administrative users of the ShareFile Storage Zones Controller. Input paths supplied by an administrator are not properly canonicalized or constrained to an intended base directory. Attackers can inject traversal sequences such as ..\ to escape the expected storage root. The result is arbitrary file read, arbitrary file write, and file existence probing across the underlying Windows filesystem. Because SZC processes typically run with elevated service privileges, the attacker inherits broad access to configuration files, credentials, certificates, and application binaries hosted on the controller.

Root Cause

The root cause is improper input validation [CWE-20] of file path parameters accepted by administrative endpoints. The application trusts path components submitted by an authenticated administrator and passes them to file I/O APIs without normalizing or restricting them to a whitelisted directory. This produces classic path traversal behavior in both read and write operations.

Attack Vector

An attacker must first hold administrative credentials on the Storage Zones Controller, which may be obtained through credential theft, phishing, or lateral movement. The attacker then issues crafted requests to the SZC administrative interface over the network. Because the scope changes on exploitation, impact extends beyond the vulnerable component to files owned by other services on the same host. Successful exploitation can be used to exfiltrate secrets, plant web shells in publicly reachable paths, or modify configuration files to establish persistence.

No verified exploit code is available. Refer to the ShareFile Service Disruption Guidance for vendor-supplied technical details.

Detection Methods for CVE-2026-15724

Indicators of Compromise

Administrative HTTP requests to the Storage Zones Controller containing traversal sequences such as ..%2f, ..\, or absolute paths in file parameters
Unexpected file writes into system directories such as C:\Windows\Temp, IIS web roots, or startup folders on the SZC host
Access to sensitive files including web.config, ShareFile configuration XML, or certificate stores by the SZC service account
New or modified files under IIS wwwroot directories not associated with a ShareFile upgrade

Detection Strategies

Review IIS and SZC application logs for administrative requests containing encoded or literal traversal characters in path or filename parameters
Alert on file creation events in directories outside the configured storage zone root initiated by the SZC service process
Correlate administrative authentication events with subsequent anomalous file I/O volumes or destinations

Monitoring Recommendations

Enable verbose request logging on the SZC administrative interface and forward to a centralized SIEM
Monitor Windows Security event ID 4663 for file access by the SZC service account outside expected storage paths
Track privileged administrator sessions and validate them against change-management records

How to Mitigate CVE-2026-15724

Immediate Actions Required

Upgrade Storage Zones Controller to version 5.12.5, 6.0.2, or later as supplied by Progress
Restrict access to the SZC administrative interface to trusted management networks and jump hosts
Rotate credentials, API keys, and certificates stored on the SZC host if compromise is suspected
Audit administrator accounts and remove unused or excessive privileges

Patch Information

Progress addresses CVE-2026-15724 in ShareFile Storage Zones Controller versions 5.12.5 and 6.0.2. Refer to the ShareFile Service Disruption Guidance for upgrade procedures and post-upgrade validation steps.

Workarounds

Place the SZC administrative interface behind a VPN or reverse proxy that enforces IP allowlisting
Enforce multi-factor authentication on all ShareFile administrative accounts to reduce the risk of credential-based access
Apply least privilege to the SZC service account so that traversal writes cannot reach system-critical directories

bash

# Configuration example: restrict SZC admin access via Windows Firewall
New-NetFirewallRule -DisplayName "SZC Admin Allowlist" `
  -Direction Inbound -Protocol TCP -LocalPort 443 `
  -RemoteAddress 10.0.10.0/24 -Action Allow

New-NetFirewallRule -DisplayName "SZC Admin Deny All" `
  -Direction Inbound -Protocol TCP -LocalPort 443 `
  -Action Block