{"id":"CVE-2026-93695","aliases":["EUVD-2026-97367","GHSA-3hhm-qff2-f56h"],"status":"published","title":"Arbitrary file write through remote file identifiers in Progress ShareFile Storage Zones Controller FileCopyService","description":"In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file identifier when constructing a local temporary file path without enforcing containment. This can cause FileCopyService to write attacker-controlled content to filesystem locations writable by the service account. This can result in remote code execution when an executable IIS-served directory is writable.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00171,"percentile":0.06532,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22","CWE-73"],"published":"2026-10-12T12:52:15Z","modified":"2026-10-15T16:08:54Z","products":[{"vendor":"progress","product":"sharefile storage zones controller"}],"references":[{"url":"https://docs.sharefile.com/en-us/sharefile/storage-zones-controller/5-0/security-vulnerability-sep26","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93695"},{"url":"https://github.com/advisories/GHSA-3hhm-qff2-f56h"}],"sources":{"cve":[{"id":"CVE-2026-93695","title":"Arbitrary file write through remote file identifiers in Progress ShareFile Storage Zones Controller FileCopyService","description":"In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file identifier when constructing a local temporary file path without enforcing containment. This can cause FileCopyService to write attacker-controlled content to filesystem locations writable by the service account. This can result in remote code execution when an executable IIS-served directory is writable.","status":"published","published":"2026-10-12T12:52:15.973Z","modified":"2026-10-13T03:55:27.886Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-73","CWE-22"],"updated_at":"2026-11-02T14:19:54.50686Z"}],"euvd":[{"id":"EUVD-2026-97367","description":"In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file identifier when constructing a local temporary file path without enforcing containment. This can cause FileCopyService to write attacker-controlled content to filesystem locations writable by the service account. This can result in remote code execution when an executable IIS-served directory is writable.","status":"published","published":"2026-10-12T12:52:15Z","modified":"2026-10-13T03:55:27Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:21.690828Z"}],"ghsa":[{"id":"GHSA-3hhm-qff2-f56h","title":"In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote...","description":"In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file identifier when constructing a local temporary file path without enforcing containment. This can cause FileCopyService to write attacker-controlled content to filesystem locations writable by the service account. This can result in remote code execution when an executable IIS-served directory is writable.","status":"published","published":"2026-10-12T15:32:16Z","modified":"2026-10-12T15:32:21Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:13:06.481163Z"}],"nvd":[{"id":"CVE-2026-93695","description":"In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file identifier when constructing a local temporary file path without enforcing containment. This can cause FileCopyService to write attacker-controlled content to filesystem locations writable by the service account. This can result in remote code execution when an executable IIS-served directory is writable.","status":"published","published":"2026-10-12T13:17:33.59Z","modified":"2026-10-15T16:08:54.067Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-22","CWE-73"],"updated_at":"2026-11-02T14:12:56.310333Z"}]}}