CVE-2026-93693: Unauthenticated queue manipulation through connector SSRF and response injection in Progress ShareFile Storage Zones Controller
In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on queue service can be chained by a remote unauthenticated attacker to issue server-side requests to unintended local handlers and perform unauthorized queue operations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress ShareFile Storage Zones Controllerto a version that resolves this vulnerability.Fixed in v5.12.7
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker does not need authentication or user interaction. Exploitation requires network access to a vulnerable Progress ShareFile Storage Zones Controller instance.
What can an attacker do if exploitation succeeds?
An attacker can chain the outbound-request validation, JSONP formatting, and queue-service validation weaknesses to make server-side requests to unintended local handlers and perform unauthorized queue operations. The stated impact is limited to integrity and availability; no confidentiality impact is identified.
Which versions are affected?
Progress ShareFile Storage Zones Controller version 5.12.6 and earlier are affected.