PT-2026-29736 · Progress · Sharefile Storagezones Controller

Piotr Bazydlo · Published 2026-04-02 · Updated 2026-04-02 · CVE-2026-2701

NVD

CVSS v3.1

9.1

Critical

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Authenticated user can upload a malicious file to the server and execute it, which leads to remote code execution.

Fix

Unrestricted File Upload

OS Command Injection

Code Injection

Weakness Enumeration

CWE-434

CWE-78

CWE-94

Related Identifiers

CVE-2026-2701

Affected Products

Sharefile Storagezones Controller

References · 6

• https://docs.sharefile.com/en-us/storage-zones-controller/5-0/security-vulnerability-feb26 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2701 · Security Note
• https://reddit.com/r/SecOpsDaily/comments/1safgbi/youre_not_supposed_to_sharefile_with_everyone · Reddit Post
• https://twitter.com/Dinosn/status/2039663000928321631 · Twitter Post
• https://twitter.com/_r_netsec/status/2039662398056132717 · Twitter Post
• https://twitter.com/secharvesterx/status/2039674301368946899 · Twitter Post