CVE-2026-93695 in ShareFile Storage Zones Controller
Summary
by MITRE • 10/12/2026
In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file identifier when constructing a local temporary file path without enforcing containment. This can cause FileCopyService to write attacker-controlled content to filesystem locations writable by the service account. This can result in remote code execution when an executable IIS-served directory is writable.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in Progress ShareFile Storage Zones Controller versions 5.12.6 and earlier stems from a critical path traversal flaw within the FileCopyService component. This service is responsible for managing file operations, including copying files between storage locations. The core technical deficiency lies in how the service constructs local temporary file paths when handling remote file identifiers provided by clients or other system components. Specifically, the application fails to enforce strict containment checks on these input values before using them as part of a filesystem path string. This lack of validation allows an attacker to manipulate the remote file identifier with directory traversal sequences, such as dot-dot-slash characters, which are then interpreted literally during path construction rather than being sanitized or resolved against a secure base directory.
This technical flaw directly leads to an insecure direct object reference scenario where the application writes data to arbitrary locations on the server's filesystem that are accessible by the service account running the ShareFile process. Under normal operational conditions, temporary files should be confined to specific, restricted directories with limited write permissions. However, due to the absence of proper path canonicalization and validation, an authenticated attacker can redirect file write operations outside these intended boundaries. The severity of this issue is significantly amplified in environments where IIS serves static content from directories that are also writable by the ShareFile service account. In such configurations, the ability to write arbitrary files allows for the placement of malicious scripts or executables into web-accessible locations.
The operational impact of this vulnerability is severe, potentially resulting in remote code execution on the affected server. If an attacker successfully exploits the path traversal weakness to upload a script file into a directory served by IIS, they can trigger its execution through standard HTTP requests. This effectively bypasses traditional network perimeter defenses and authentication mechanisms associated with the ShareFile application interface itself. The compromise of the underlying operating system grants the attacker full control over the server environment, enabling them to exfiltrate sensitive data stored within the ShareFile infrastructure, pivot to other internal systems, or establish persistent backdoors for long-term access.
To mitigate this risk, organizations must immediately apply the vendor-provided patches that address the path validation logic in FileCopyService. Until patching is feasible, administrators should review IIS configurations to ensure that directories serving static content are not writable by the ShareFile service account, thereby breaking the chain of exploitation required for remote code execution. Additionally, implementing strict file upload restrictions and validating all input parameters against a whitelist of allowed characters can provide defense-in-depth measures. Regular security audits focusing on path traversal vulnerabilities in web applications handling user-supplied filenames are essential to prevent similar issues from arising in other components of the infrastructure.