PT-2026-110579 · Progress · Sharefile Storagezones Controller
CVE-2026-93694
·
Published
2026-10-12
·
Updated
2026-10-12
CVSS v3.1
4.0
Medium
| Vector | AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L |
In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition allows the attacker to cause FileCopyService to consume attacker-controlled metadata and content. Exploitation requires control over copy queue work and a race condition.
Fix
SSRF
Race Condition
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Sharefile Storagezones Controller