CVE-2026-93693

In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL. This behavior together with a race condition allows an attacker to cause FileCopyService to consume attacker-controlled metadata and content.

In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file identifier when constructing a local temporary file path without enforcing containment. This can cause FileCopyService to write attacker-controlled content to filesystem locations writable by the service account. This can result in remote code execution when an executable IIS-served directory is writable.

In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling attacker-controlled files to be written outside the intended preparation directory. This can lead to remote code execution in v5 versions; RCE is not confirmed on v6.

In Progress ShareFile Storage Zones Controller v5.12.5 and below, unsafe deserialization of untrusted file metadata can allow a user with write access to a Network share to execute arbitrary code on the Storage Zones Controller host.

In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perform path traversal using resumable upload initiation endpoint, allowing the party to write arbitrary content to any location writable by the application's service account. This may result in the execution of attacker-supplied code.

Vulnerability in Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2. An authenticated administrative user can exploit a path traversal vulnerability to read arbitrary files, write files to arbitrary directories, or determine whether specific files exist on the server.