CVE-2025-59872
published 2026-06-17CVE-2025-59872: HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability, If the server is configured to execute code, then it may be possible to obtain…
PriorityP267critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.45%
36.1th percentile
HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability, If the server is configured to execute code, then it may be possible to obtain command execution on the server by uploading a file known as a web shell, which allows you to execute arbitrary code or operating system commands. For this attack to be successful, the file needs to be uploaded inside the Webroot, and the server must be configured to execute the code
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hcl_software | zie | — | — |
| hcltech | zie_for_web | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvelistv5v3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
HCL ZIE 16.0 File Upload information exposure (KB0131549 / EUVD-2025-210240)
vuldb·2026-06-27·CVSS 9.8
CVE-2025-59872 [CRITICAL] HCL ZIE 16.0 File Upload information exposure (KB0131549 / EUVD-2025-210240)
A vulnerability, which was classified as problematic, has been found in HCL ZIE 16.0. This affects an unknown part of the component File Upload Handler. Performing a manipulation results in information exposure through error message.
This vulnerability is reported as CVE-2025-59872. The attack is possible to be carried out remotely. No exploit exists.
CVEList
HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability,
cvelistv5·2026-06-17·CVSS 4.3
CVE-2025-59872 [MEDIUM] CWE-209 HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability,
HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability,
HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability, If the server is configured to execute code, then it may be possible to obtain command execution on the server by uploading a file known as a web shell, which allows you to execute arbitrary code or operating system commands. For this attack to be successful, the file needs to be uploaded inside the Webroot, and the server must be configured to execute the code
GHSA
HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability, If the server is configured to execute code, then it may be possible to obtain command execution on the server by uploading a
ghsa_unreviewed·2026-06-17
CVE-2025-59872 [MEDIUM] CWE-209 HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability, If the server is configured to execute code, then it may be possible to obtain command execution on the server by uploading a
HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability, If the server is configured to execute code, then it may be possible to obtain command execution on the server by uploading a file known as a web shell, which allows you to execute arbitrary code or operating system commands. For this attack to be successful, the file needs to be uploaded inside the Webroot, and the server must be configured to execute the code
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-17
Published