Authenticated file write via path traversal

Arbitrary file write in Progress ShareFile Storage Zones Controller before 5.12.6 or 6.0.3 allows remote authenticated users to escape the preparation directory. The download preparation flow performs improper validation on zone-administrator-controlled file paths, allowing prepared files to be written outside the intended staging location into other paths writable by the controller service account. Zone administrator access is required; Progress states that this can result in remote code execution on 5.x, while comparable code execution on 6.0.0 through 6.0.2 is not confirmed.