Progress ShareFile zero-day forced emergency server shutdowns; patch is out
A path traversal flaw in Storage Zone Controllers let admin users read and write files they shouldn't. Progress says no customer breach has been found.
Key points
- Progress Software confirmed a high-severity zero-day, meaning a flaw the vendor hadn't previously patched, is behind the emergency shutdown of ShareFile Storage Zone Controllers.
- The bug is a path traversal vulnerability affecting all 5.x and 6.x versions of ShareFile Storage Zone Controller.
- Progress has released fixed versions 5.12.5 and 6.0.2 and told customers to install them before bringing servers back online.
- A CVE identifier has been reserved and will be published in roughly two weeks.
- Progress says it has found no evidence that any customer account or data was accessed.
Progress Software has confirmed what many of its customers suspected: a serious, previously unknown flaw is why they were told to yank their file-sharing servers offline in a hurry. We reported the original shutdown order on 10 July, when Progress cited a "credible external security threat" but gave no technical detail.
ShareFile Storage Zone Controller is software companies run on their own Windows servers to keep sensitive files in-house while using ShareFile's cloud service for logins and sharing. Think of it as the on-site vault behind a cloud front door. Progress also cut off access to any ShareFile account using a Storage Zone Controller while it investigated.
The bug is a path traversal flaw, a class of weakness that lets an attacker trick software into reading or writing files outside the folders it's supposed to touch.
In Progress's own words, seen in a customer email first reported by BleepingComputer: "An authenticated administrative user can read arbitrary files accessible to the application's service account, write threat actor-controlled content to arbitrary directories or enumerate the server filesystem layout."
Someone with an admin login could pull files off the server, drop malicious files onto it, or map out its contents. Storage Zone Controllers hold the actual documents customers upload, which makes them a valuable target for extortion crews.
Were any customers actually breached?
Progress says no, at least not that it can see. "Currently, we have no indication of unauthorized access to any ShareFile customer account or data, and we have not identified any active threat," the company told customers.
That's a careful statement. It means Progress hasn't found evidence of intrusions, not that intrusions are impossible. Progress hasn't said whether the flaw was found internally or reported by an outside researcher, and hasn't explained why the CVE won't be published for roughly two weeks.
The capability described here is exactly what data-theft gangs look for. Groups like Cl0p have built entire campaigns around Progress file-transfer products before, most famously the 2023 MOVEit Transfer attacks that hit hundreds of organisations. That's capability, not confirmed intent. No attribution has been offered by Progress or third-party researchers as of publication.
What should ShareFile customers do now?
Install the fix. Progress has published ShareFile Storage Zone Controller 5.12.5 and 6.0.2. Only bring servers back online after the update is in place.
Organisations should also check logs from before the shutdown for unusual admin activity or files appearing in unexpected directories. Because the flaw requires an authenticated admin account, any sign that admin credentials were phished or shared with third parties is worth pursuing.
End users, the staff who upload and download documents, don't need to act themselves. Their access was suspended during the incident and will be restored by IT once servers are patched.
Path traversal flaws in file-transfer products are a recurring theme on this beat. Our 15 June report on Langflow's unauthenticated file-write flaw showed how similar primitives get weaponised fast once they're public. The CVE publication delay here is the detail worth watching: two weeks is enough time for threat actors to reverse-engineer the patches if they haven't already.
We'll update this story if Progress releases further technical detail or the reserved CVE is published.
