CVE-2026-93695— Arbitrary file write through remote file identifiers in Progress ShareFile Storage Zones Controller FileCopyService
Quick assessment
Affected
Progress ShareFile Storage Zones Controller
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 ShareFile Storage Zones Controller v5.12.6 及更早版本中，FileCopyService 在构建本地临时文件路径时使用远程文件标识符，但未强制实施路径隔离（containment）。这可能导致 FileCopyService 将攻击者可控的内容写入服务账户拥有写入权限的文件系统位置。如果该位置是 IIS 托管的、且允许执行可执行文件的目录，则可能导致远程代码执行。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1203 · Exploitation for Client ExecutionAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Progress | ShareFile Storage Zones Controller | ≤ 5.12.6 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-93695
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Arbitrary file write through remote file identifiers in Progress ShareFile Storage Zones Controller FileCopyService
Source: CVE Program / CVE List V5
Vulnerability Description
In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file identifier when constructing a local temporary file path without enforcing containment. This can cause FileCopyService to write attacker-controlled content to filesystem locations writable by the service account. This can result in remote code execution when an executable IIS-served directory is writable.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
文件名或路径的外部可控制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Progress | ShareFile Storage Zones Controller | 0 ~ 5.12.6 | - |
|
II. Public POCs for CVE-2026-93695
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-93695
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-93695 (1)
-
🔗 Security Vulnerability Fix (September 2026) vendor-advisory
Same Patch Batch · Progress · 2026-10-12 · 3 CVEs total
| CVE-2026-93693 | 6.5 MEDIUM | Unauthenticated queue manipulation through connector SSRF and response injection in Progre |
| CVE-2026-93694 | 4.0 MEDIUM | Untrusted request routing and forged acknowledgements permit copy-workflow manipulation in |
IV. Related Vulnerabilities
Same product: ShareFile Storage Zones Controller
-
CVE-2026-93694
Untrusted request routing and forged acknowledgements permit -
CVE-2026-93693
Unauthenticated queue manipulation through connector SSRF an -
CVE-2026-16137
Path traversal via unsanitized upload filename leads to arbi -
CVE-2026-16138
Remote code execution via unsafe deserialization in Progress -
CVE-2026-16139
Arbitrary file write via path traversal in Progress ShareFil
Same vendor: Progress
-
CVE-2026-93694
Untrusted request routing and forged acknowledgements permit -
CVE-2026-93693
Unauthenticated queue manipulation through connector SSRF an -
CVE-2026-16137
Path traversal via unsanitized upload filename leads to arbi -
CVE-2026-16138
Remote code execution via unsafe deserialization in Progress -
CVE-2026-16139
Arbitrary file write via path traversal in Progress ShareFil
Same weakness: CWE-73
-
CVE-2026-110385
ONLYOFFICE Document Server <10.0.0 RCE漏洞 -
CVE-2026-69783
Windows Update Elevation of Privilege Vulnerability -
CVE-2026-106042
Ivanti Xtraction路径遍历致凭证泄露漏洞 -
CVE-2026-103928
Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in F -
CVE-2026-109601
Frappe Framework before v16.30.0 Arbitrary File Read via Out
V. Comments for CVE-2026-93695
No comments yet