CVE-2026-93695: Arbitrary file write through remote file identifiers in Progress ShareFile Storage Zones Controller FileCopyService
In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file identifier when constructing a local temporary file path without enforcing containment. This can cause FileCopyService to write attacker-controlled content to filesystem locations writable by the service account. This can result in remote code execution when an executable IIS-served directory is writable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress ShareFile Storage Zones Controllerto a version that resolves this vulnerability.Fixed in v5.12.7
Event History
Frequently Asked Questions
Which deployments are most exposed to remote code execution?
Deployments where the FileCopyService account can write to an IIS-served directory that permits executable content are exposed to remote code execution. Other writable locations may still allow attacker-controlled file writes, but the provided information specifically identifies executable IIS-served directories as the route to code execution.
What access does an attacker need to exploit this issue?
The supplied severity vector indicates no privileges or user interaction are required, but exploitation has high attack complexity and requires local attack-vector conditions. The vulnerability involves controlling a remote file identifier used by FileCopyService to construct a temporary local path.
Are default installations known to be affected?
The available information identifies affected versions as Progress ShareFile Storage Zones Controller 5.12.6 and below, but does not state whether the vulnerable condition is present in a default configuration. Exposure depends on filesystem locations writable by the FileCopyService account and whether any such location is an executable IIS-served directory.
What can be done if an update cannot be applied immediately?
Reduce the FileCopyService account's write permissions, particularly removing its ability to write to IIS-served directories that allow executable content. Review writable paths available to that service account, since the issue allows writes to filesystem locations writable by the account.