CVE-2026-93695CWE-22CWE-73path-traversal
CVE-2026-93695
High · published October 12, 2026
What it is
In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file identifier when constructing a local temporary file path without enforcing containment. This can cause FileCopyService to write attacker-controlled content to filesystem locations writable by the service account. This can result in remote code execution when an executable IIS-served directory is writable.
The record
Technical detail
- CVSS v3.1
- 7.4 · HIGH
- Vector
- CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v4.0
- Not supplied
- EPSS
- 0.00171 · 6.1th percentile
- Weaknesses
- CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-73 · External Control of File Name or Path
- Published
- 2026-10-12T17:17Z
References (1)
EPSS history
Timeline
14 OCT 03:33Z
EPSS moved — → 0%
epss
12 OCT 12:52Z
Arbitrary file write through remote file identifiers in Progress ShareFile Storage Zones Controller FileCopyService
cvelistv5
12 OCT 12:52Z
Arbitrary file write through remote file identifiers in Progress ShareFile Storage Zones Controller FileCopyService
cvelistv5