CVE-2026-93695
Arbitrary file write through remote file identifiers in Progress ShareFile Storage Zones Controller FileCopyService
CVSS Score
7.4
EPSS Score
0.0%
EPSS Percentile
0th
In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file identifier when constructing a local temporary file path without enforcing containment. This can cause FileCopyService to write attacker-controlled content to filesystem locations writable by the service account. This can result in remote code execution when an executable IIS-served directory is writable.
| CWE | CWE-73 CWE-22 |
| Vendor | progress |
| Product | sharefile storage zones controller |
| Published | Oct 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for progress sharefile storage zones controller
Be the first to know when new high vulnerabilities affecting progress sharefile storage zones controller are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Progress / ShareFile Storage Zones Controller
0 ≤ 5.12.6