Information disclosure through error messages in HCL Software ZIE
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure, Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-209 and CWE-434.
Summary
HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability, If the server is configured to execute code, then it may be possible to obtain command execution on the server by uploading a file known as a web shell, which allows you to execute arbitrary code or operating system commands. For this attack to be successful, the file needs to be uploaded inside the Webroot, and the server must be configured to execute the code
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| HCL Software | ZIE | 16.0 | — | No fix listed | CNA |
- ZIE VendorHCL Software Affected 16.0 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:hcltech:zie_for_web:16.0:*:*:*:*:*:*:* | 16.0 | Vulnerable | HCL Software |
- cpe:2.3:a:hcltech:zie_for_web:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·HCL Software
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-59872
- 2026-10-03 Alias added: GHSA-53ch-q6q5-vjm5
References
Sources
- CVE-2025-59872 · CVE Program
- CVE-2025-59872 · NVD
- FIRST EPSS
- GHSA-53ch-q6q5-vjm5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences