CVE-2026-93694: Untrusted request routing and forged acknowledgements permit copy-workflow manipulation in Progress ShareFile Storage Zones Controller
In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition allows the attacker to cause FileCopyService to consume attacker-controlled metadata and content. Exploitation requires control over copy queue work and a race condition.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress ShareFile Storage Zones Controllerto a version that resolves this vulnerability.Fixed in v5.12.7
Event History
Frequently Asked Questions
What access or capabilities does an attacker need to exploit this issue?
The attacker must be able to control copy queue work and successfully win a race condition during queue-item processing. The provided data does not identify a specific required account type or access path for gaining that control.
Which component is affected by the manipulated workflow?
The issue can cause FileCopyService to consume attacker-controlled metadata and content after queue-item acknowledgements are sent to an unvalidated callback URL.
Are newer releases known to be affected?
The affected range is Progress ShareFile Storage Zones Controller version 5.12.6 and below. The provided data does not state which version, if any, contains a fix.