An unrestricted file upload flaw in HCL ZIE for Web allows an attacker to place arbitrary files on the server’s webroot. If the web server is configured to execute uploaded content, the attacker can upload a web shell or other executable files and run arbitrary code or operating system commands, thereby compromising confidentiality, integrity, and potentially availability. The weakness stems from inadequate validation of uploaded file types (CWE‑434) and from permitting execution of uploaded files (CWE‑209).

All installations of HCL Software ZIE for Web, particularly those that permit uploaded files to be executed within the webroot, are potentially vulnerable. The issue applies to the 16.0 release referenced by the CPE string, and any other unpatched version that offers unrestricted upload functionality.

The CVSS score of 4.3 points to a moderate overall risk. The EPSS score of less than 1% indicates a very low probability of active exploitation at the time of this assessment, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to successfully upload a file to a directory that the web server treats as executable; if the server configuration disallows execution in the upload path, the attack vector is mitigated. Accordingly, the primary threat exists in environments where upload directories are misconfigured to allow execution of uploaded code.