External risk intelligence

HCL ZIE for Web Unrestricted File Upload leading to Command Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-59872

HCL ZIE for Web is a terminal emulation solution typically deployed as a web-based portal to provide remote access to host applications. As an internet-facing gateway or web application designed for external connectivity, the product is commonly exposed to the network to facilitate user access.

Unrestricted File Upload

Hcltech Zie For Web

16.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An unrestricted file upload vulnerability in HCL ZIE for Web could allow an attacker to execute commands on the server if the server is configured to run code from uploaded files. This situation requires the malicious file to be placed within the Webroot.

Uploading malicious files could let attackers run commands.
Critical risk: Web applications often face the internet.
Confirm if our web access points use this technology.

Attack Path

How an attacker could exploit the issue

An attacker can exploit an unrestricted file upload vulnerability in HCL ZIE for Web by uploading a web shell to the server's web root. If the server is configured to execute code, this uploaded file can lead to the attacker gaining command execution on the server.

Requires network access and no authentication.
Uploading a web shell to the web root.
Potential for arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to upload a malicious file to the server's webroot. If the server is configured to execute code within the webroot, this uploaded file, known as a web shell, could enable the attacker to run arbitrary commands on the server.

Server command execution.
File upload to webroot when supported.
Arbitrary code execution on server.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in HCL ZIE for Web, allowing unrestricted file uploads that can lead to command execution, likely impacts organizations providing web-based access to host applications. Ownership typically resides with the platform or application team responsible for the ZIE for Web deployment. The immediate first step is to identify all instances of the affected technology, assess their exposure and business criticality, and then confirm the accountable owner to plan remediation.

Platform or application teams own the issue.
Verify ZIE for Web instances and exposure.
Plan remediation based on business risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is HCL ZIE for Web?

HCL ZIE for Web is a terminal emulation solution. Organizations use it as a web-based portal to provide remote, browser-based access to legacy host applications, often serving as a central gateway for users to connect to mainframe or midrange systems from their desktops.

What does CWE-434 mean for CVE-2025-59872?

This CVE involves an Unrestricted File Upload weakness, classified as CWE-434. In plain terms, the software fails to properly validate or limit the files a user can upload. Because of this, an attacker might be able to send a file that the server mistakenly interprets as a program or script, potentially granting them unauthorized control.

How does an attacker trigger this vulnerability?

An attacker must successfully upload a malicious file, often called a web shell, specifically into the application's web root directory. Simply uploading a file is not enough; the server must also be specifically configured to execute code files located in that directory for the attack to succeed.

Is my instance of HCL ZIE for Web at risk?

According to Halo Surface Signal, this product is frequently deployed as an internet-facing gateway to enable remote connectivity, which increases the likelihood of external access. If your installation is accessible from the public internet, it faces a higher potential for exploitation compared to systems restricted to internal network segments.

What should I do first to address this CVE?

Begin by auditing your environment to create an inventory of all HCL ZIE for Web instances. Once identified, evaluate the business criticality and network exposure of each deployment. Coordinate with the specific platform or application teams managing these servers to prioritize remediation steps and ensure the configuration prevents unauthorized code execution.

References

support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131549

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.