CVE-2025-59872

CriticalCVSS 9.8/10Last modified Oct 6, 2026

Description

HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability, If the server is configured to execute code, then it may be possible to obtain command execution on the server by uploading a file known as a web shell, which allows you to execute arbitrary code or operating system commands. For this attack to be successful, the file needs to be uploaded inside the Webroot, and the server must be configured to execute the code

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-209 CWE-434

Affected software

Vendor	Product	Versions
HCL Software	ZIE	16.0

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131549Vendor Advisory

Timeline

Published: Jun 17, 2026
Last modified: Oct 6, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-598735.9An information exposure vulnerability exists in Vulnerability in HCL Software ZIE for Web. The application transmits sensitive session tok CVE-2025-598748.1HCL Hive Telco Observability is affected by a Required directives missing from the CSP issue is detected in keycloak component of the web a CVE-2025-59885.3A flaw was found in the Ansible aap-gateway. Cross-site request forgery (CSRF) origin checking is not done on requests from the gateway to e CVE-2025-598868.8Improper input validation at one of the endpoints of Eaton xComfort ECI's web interface, could lead into an attacker with network access t CVE-2025-598878.6Improper authentication of library files in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker CVE-2025-598886.7Improper quotation in search paths in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with CVE-2025-598898.6Improper authentication of library files in the Eaton IPP software installer could lead to arbitrary code execution of an attacker with the CVE-2025-598907.3Improper input sanitization in the file archives upload functionality of Eaton Galileo software allows traversing paths which could lead int CVE-2025-598918.0Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticat CVE-2025-598928.0Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticat CVE-2025-598938.0Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticat CVE-2025-598948.0Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticat