CVE-2025-59872 is an unrestricted file upload flaw in HCL ZIE for Web, scored CVSS 4.3 (medium). It leads to command execution only if the file lands in the web root and the server runs code there. Confirm the fixed build in HCL's article and update.
What's affected
The NVD record names HCL ZIE for Web and lists CWE-209 and CWE-434. The description says the attack needs two conditions: the uploaded file must land inside the web root, and the server must be configured to execute that kind of code. No version ranges are given.
The HCL support portal did not return article text when I fetched it, so this guide relies on the NVD record. Read the article itself for the fixed version.
How to check if you're exposed
HCL publishes the affected and fixed builds for ZIE for Web in its knowledge base article, and that article is the authority. I could not read its text when preparing this guide, so I will not state a fixed version here.
- Find the build you run. The admin or about page of the product usually shows it, and so does your deployment record.
- Open the HCL article listed under Sources and compare your build with its list of affected and fixed builds.
- If the article lists a fix and you are behind it, you are exposed to the issue described here. If your build is not named, ask HCL support to confirm in writing.
Those two conditions give you a direct test. Find the directory that receives uploads, and check whether it sits inside the web root and whether the web server will run scripts from it. If either answer is no, the stated attack does not apply, though you should still update.
What to do now
- Identify ZIE for Web deployments and their builds.
- Apply the build the HCL article names.
- Confirm uploads are stored outside the web root.
- Turn off script execution for any directory that must stay inside the web root.
- Review how errors are shown to users, since the CWE-209 entry means error messages can reveal internal detail.
Why it matters
Two weaknesses are tagged here. CWE-434 is the unrestricted upload, and CWE-209 is information exposure through an error message. The upload is the main concern, and the conditions in the description show how defense in depth helps: even an accepted file does nothing if the server will not execute it.
The medium score reflects those conditions. Treat the web root check as a quick win that reduces risk across many applications, not just this one.
Quick check
Does the web root condition really stop the attack?
The record says the attack needs the file inside the web root and a server that executes code. Removing either condition removes that route, but update anyway.
Sources
Last reviewed: 19 October 2026.
