🚨 HIGH - Authenticated path traversal in ShareFile Storage Zones Controller (CVE-2026-15724) CVE-2026-15724 is a path traversal flaw in the ShareFile Storage Zones Controller that allows misuse of file-handling functionality to escape intended directories. The root cause is improper input validation of filesystem paths, enabling directory traversal sequences to reach arbitrary locations. An authenticated administrative user can exploit this via crafted requests that manipulate path parameters to read from or write to unintended directories, or to probe for file existence. Impact includes arbitrary file read (potentially exposing secrets/configs), arbitrary file write to attacker-chosen paths (enabling persistence or follow-on compromise), and filesystem reconnaissance. 👉 Affected: ShareFile Storage Zones Controller < 5.12.5 and 6.0.0-6.0.1 | Upgrade to 5.12.5 or 6.0.2
Post summary
ShareFile Storage Zones Controller is affected by an authenticated path traversal flaw that allows arbitrary file read and write; users should upgrade to 5.12.5 or 6.0.2 to fix the issue.