This vulnerability allows an authenticated user to upload a malicious file to the Progress ShareFile Storage Zones Controller and execute it, resulting in remote code execution. The flaw arises from insufficient validation of uploaded content, permitting arbitrary code to run on the server. Attackers can compromise the confidentiality, integrity, and availability of the affected system and potentially gain full control of the underlying host.

The affected product is Progress ShareFile Storage Zones Controller. Specific version information is not disclosed, so all deployed instances of this product may be vulnerable unless they have been patched recently. Users with upload privileges in the system are the ones who can exploit this flaw.

The CVSS score of 9.1 indicates a critical level of severity. While an EPSS score is not available, the vulnerability remains significant. The information does not list it in the CISA KEV catalog, but the impact is severe. The likely attack vector is through an authenticated user who is permitted to upload files, indicating that internal or compromised accounts could be used to trigger the exploit. No additional conditions are specified, so the exploit appears straightforward once an authenticated session is established.