# CVE-2026-93695: Progress ShareFile Storage Zones Controller path traversal in FileCopyService

Source: https://junglewise.ai/threats/cve-2026-93695-in-progress-sharefile-storage-zones-controller-v5-12-6-and-below  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-93695 · Severity: high · CVSS 7.4 · Published 2026-10-12

ShareFile Storage Zones Controller is a file storage and sharing platform used by enterprises to manage data across zones. A flaw in the FileCopyService component allows an attacker to write malicious files to locations controlled by the service account without proper validation. If an attacker writes executable content to a web-accessible directory, they can execute arbitrary code on the server.

Technologies: [Progress ShareFile Storage Zones Controller](https://junglewise.ai/threats/technologies/progress-sharefile-storage-zones-controller). Vendors: [Progress](https://junglewise.ai/threats/vendors/progress).

## Quick answers

**Is CVE-2026-93695 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93695 being exploited in the wild.

**How severe is CVE-2026-93695?** High severity, with a CVSS score of 7.4, published 12 October 2026.

**Which products and versions are affected?** Progress ShareFile Storage Zones Controller 5.12.6 and below.

**Is there a fix for CVE-2026-93695?** Yes: fixed in ShareFile Storage Zones Controller 5.12.7, 6.x. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-93695 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-93695?** Check whether you run Progress ShareFile Storage Zones Controller at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in ShareFile Storage Zones Controller 5.12.7, 6.x

## Technical details

The FileCopyService constructs local file paths using remote file identifiers without enforcing path containment checks, enabling a path traversal attack. An unauthenticated attacker can chain this vulnerability with two other CVEs (CVE-2026-93693 and CVE-2026-93694) to bypass authentication, manipulate copy jobs, and write attacker-controlled content to arbitrary filesystem locations writable by the service account, potentially achieving remote code execution if the target directory is served by IIS.

## Affected products

- Progress ShareFile Storage Zones Controller 5.12.6 and below

## Timeline

- 2026-10-12: disclosed

## References

- [https://docs.sharefile.com/en-us/sharefile/storage-zones-controller/5-0/security-vulnerability-sep26](https://docs.sharefile.com/en-us/sharefile/storage-zones-controller/5-0/security-vulnerability-sep26)

## Related threats

- [Progress ShareFile Storage Zones Controller unvalidated callback processing](https://junglewise.ai/threats/cve-2026-93694-in-progress-sharefile-storage-zones-controller-v5-12-6-and-below)
- [Authenticated user can upload a malicious file to the server and execute it, which leads to remote code execution.](https://junglewise.ai/threats/cve-2026-2701-authenticated-user-can-upload-a-malicious-file-to-the-server-and)
- [Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthenticated attacker to access restricted…](https://junglewise.ai/threats/cve-2026-2699-customer-managed-sharefile-storage-zones-controller-szc-allows-an)