An arbitrary file write vulnerability exists in Progress ShareFile Storage Zones Controller where a remote file identifier is used to construct a local temporary path without enforcing containment. This flaw allows an attacker to write files to any location writable by the service account, and if the written file resides in an IIS-served directory that is executable, the attacker can execute code on the server. The weakness is a classic file traversal/unsanitized path construction error that grants both confidentiality and integrity compromise, escalating to remote code execution as noted in the advisory.

Progress ShareFile Storage Zones Controller versions 5.12.6 and earlier are affected. The vendor has resolved the issue in version 5.12.7 and later; users of older releases should review upgrade paths accordingly.

The CVSS score of 7.4 indicates that the vulnerability presents a high severity risk. There is no publicly available EPSS data, and the vulnerability is not listed in the CISA KEV catalog. Attack vectors are inferred to be remote, requiring the ability to invoke the FileCopyService with a crafted remote file identifier, and success depends on the presence of writable directories that are served by IIS. Given these conditions, the risk remains significant for exposed installations.