EUVD-2026-97367
GHSA-3hhm-qff2-f56h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach FileCopyService with remote file identifier
-
DeliveryInject path traversal into temp path
-
ExploitWrite payload into writable IIS directory
-
ExecutionIIS executes planted file
-
ImpactCode execution as service account
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Two concrete prerequisites: (1) the attacker must be able to control or influence the remote file identifier consumed by FileCopyService on ShareFile Storage Zones Controller 5.12.6 or earlier, and (2) for code execution specifically, an IIS-served directory must be both executable and writable by the Storage Zones service account. The arbitrary file write itself succeeds against any filesystem location writable by the service account; escalation to RCE is limited to deployments with a writable, executable IIS directory - a non-default hardening gap. Exploitation is further limited by the vendor's high attack complexity (AC:H), reflecting reliance on that specific writable/executable configuration. |
| Impact | Signals are mixed and point to a configuration-dependent, moderate-priority issue rather than a mass-exploitation emergency. The vendor-assigned CVSS 7.4 (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) encodes high complexity and a local attack vector, yet the description centers on a 'remote file identifier' driving the traversal, which implies the triggering input reaches FileCopyService over the network - CVSS indicates local vector but the described mechanism implies network-reachable input, so the true attack vector should be verified with Progress. There is no EPSS score, no CISA KEV listing, and no public exploit code referenced, so exploitation status is: no public exploit identified at time of analysis. The RCE outcome is further gated on a non-default condition (an IIS-served directory that is both executable and writable by the service account), which materially lowers real-world impact for hardened deployments. Net: a genuine arbitrary-file-write-to-RCE primitive worth patching on exposed Storage Zones Controllers, but absent EPSS/KEV/POC evidence it reads as a high-CVSS-but-conditional issue, not confirmed widespread exploitation. |
| Exploit ScenarioDerived | An attacker who can influence the remote file identifier handed to FileCopyService supplies a traversal sequence so the service writes attacker-controlled content outside the intended temporary path. If that write lands in an IIS-served directory that is executable and writable by the service account, the planted file is served and executed, yielding remote code execution. No public proof-of-concept is referenced, and the vendor's AC:H reflects the dependency on that specific writable/executable directory condition. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Arbitrary file write in Progress ShareFile Storage Zones Controller 5.12.6 and earlier lets an unauthenticated remote attacker who can influence the remote file identifier consumed by FileCopyService place attacker-controlled content into any filesystem location writable by the Storage Zones service account. Escalating that write to remote code execution requires a second, non-default condition: an IIS-served directory that is both executable and writable by that same account, which is why the assessed attack complexity is high. No public exploit code has been identified at time of analysis, and the risk profile is configuration-dependent rather than a mass-exploitation emergency.
RemediationAI
No fixed version is identified in the available data, so the primary action is to treat the vendor advisory at https://docs.sharefile.com/en-us/sharefile/storage-zones-controller/5-0/security-vulnerability-sep26 as the source of truth and apply the updated Storage Zones Controller build it points to as soon as it is released. Until then, break the RCE chain by removing execute permission from any IIS-served directory that the Storage Zones service account can write to - the arbitrary file write then remains possible but cannot be turned into code execution; the trade-off is that legitimate web-facing content directories must be served from a separate, non-writable location. In parallel, tighten the service account to least privilege so it cannot write outside its dedicated temp and data directories, and audit ACLs on IIS web roots for stray write grants; this limits the blast radius but can break file-copy workflows that rely on broader write access. Where the remote file identifier is sourced from an untrusted party, restrict inbound access to the Storage Zones Controller endpoints (network segmentation or allow-listing the ShareFile cloud egress ranges) so that identifier cannot be attacker-influenced at all, accepting that this adds network complexity and can disrupt legitimate cloud-to-zone synchronization if the ranges are configured incorrectly.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-22 improper limitation of a pathname to a restricted directory (path traversal) inside FileCopyService, a component of Progress ShareFile's on-premises Storage Zones Controller - the IIS-hosted agent that brokers file operations between the ShareFile cloud and customer-managed storage. FileCopyService derives a local temporary file path from a remote file identifier but never enforces containment on the resulting path, so a crafted identifier can escape the intended temporary directory and redirect the write to arbitrary locations permitted by the service account's ACLs. The published CVSS 3.1 vector is AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (7.4), while our independent assessment scores it AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting that the identifier is supplied remotely; both agree on high attack complexity, no required privileges, and high confidentiality, integrity, and availability impact. Exploitation reliably yields only an arbitrary file write; RCE is contingent on a writable, executable IIS-served directory, a hardening gap rather than a default configuration, so the vector's AC:H is doing real work here.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
FileCopyService processes attacker-influenced remote file identifiers (network-reachable, hence AV:N over vendor's AV:L); RCE depends on a non-default writable/executable IIS directory, giving AC:H; vendor PR:N retained.
Primary rating from Vendor (progress).
CVSS VectorVendor: progress
DescriptionCVE.org
In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file identifier when constructing a local temporary file path without enforcing containment. This can cause FileCopyService to write attacker-controlled content to filesystem locations writable by the service account. This can result in remote code execution when an executable IIS-served directory is writable.
Executive ViewAI
Progress ShareFile Storage Zones Controller versions 5.12.6 and earlier contain a high-severity arbitrary file write vulnerability that could enable an attacker to place malicious content on the server, potentially achieving remote code execution if a specific non-default configuration is present. No public exploit identified at time of analysis and no vendor-released patch identified at time of analysis, so organizations using this product must rely on interim mitigations to reduce risk. Leadership should prioritize reviewing affected deployments and enforcing strict filesystem permissions to prevent unauthorized writes.
Restrict filesystem permissions for the Storage Zones service account to least privilege, ensure no IIS-served directory is both writable and executable by that account, monitor for anomalous file writes in web-accessible paths, and subscribe to vendor advisories for patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB