CVE-2026-93695

Executive Summary

CVE-2026-93695 is a path traversal (CWE-22) vulnerability in the Progress ShareFile Storage Zones Controller component FileCopyService affecting versions 5.12.6 and below. The service constructs a local temporary file path using a remote file identifier without enforcing path containment, allowing an attacker to influence where content is written on the host filesystem. Because the service account may hold write access to IIS-served directories, successful exploitation can escalate to remote code execution on the affected server.

Technical Analysis

The vulnerability resides in the FileCopyService component of ShareFile Storage Zones Controller. According to the NVD description, the service "uses a remote file identifier when constructing a local temporary file path without enforcing containment." In practical terms, the flaw is a classic path traversal / unsafe path construction issue:

• A remote-controlled value (the file identifier) is concatenated into a local filesystem path.
• No containment check ensures the resolved path stays within the intended temporary directory.
• Attacker-influenced traversal sequences (or equivalent identifier abuse) can redirect the write target to arbitrary locations writable by the service account.

The root cause maps to CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The critical aggravating factor stated in the advisory is that the service account may have write permission to a directory that is also served and executed by IIS. When write access to an executable, IIS-served location exists, the arbitrary-write primitive becomes an RCE primitive — the attacker can place content that the web server subsequently executes.

CVSS v3.1 scoring reflects this: a base score of 7.4 (High) with vector CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Note the local attack vector (AV:L) and high complexity (AC:H): exploitation assumes the attacker can supply or influence the remote file identifier processed by FileCopyService and that a favorable write target exists. No privileges (PR:N) and no user interaction (UI:N) are required. Confidentiality, Integrity, and Availability impacts are all High.

No OSV package data, affected version enumeration, or patch sources were provided. No public proof-of-concept, Nuclei template, or exploit code is known.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (path traversal / unsafe path construction) and the details present in the NVD description.

1. Reconnaissance / target identification. An attacker identifies an exposed ShareFile Storage Zones Controller instance (v5.12.6 or below). Because the controller interacts with remote file identifiers, the attacker needs a means to cause FileCopyService to process an attacker-influenced identifier — typically by participating in a file copy operation the service handles.

2. Triggering the flaw class. The attacker supplies a remote file identifier that, when used to build the local temporary file path, resolves outside the intended temporary directory. Because containment is not enforced, the composed path can point to any location writable by the service account. In a path-traversal vulnerability of this class, the malicious identifier embeds directory-traversal sequences (e.g., ../) or an otherwise crafted value that escapes the base directory.

3. Payload / write primitive. The attacker-controlled content is written to the attacker-chosen writable location. The exploit does not require a memory-corruption primitive — it is a write-what-where at the filesystem layer, bounded only by the service account's file permissions.

4. Execution and post-exploitation. Per the NVD description, when the chosen write target is a directory that is both writable by the service account and served as executable content by IIS, the written file can execute in the web server context. This yields remote code execution, enabling the attacker to run commands, persist, or move laterally under the privileges of the IIS/service account.

The key precondition is environmental: exploitation to RCE depends on the deployment having an executable, IIS-served directory that the service account can write to. Without that precondition, the impact is still an arbitrary file write (High integrity impact), which can enable configuration tampering, log injection, or denial of service.

Impact Assessment

• Confidentiality (C:H): Arbitrary file write combined with code execution can expose files accessible to the service/IIS account.
• Integrity (I:H): The attacker directly controls written file contents at an attacker-influenced path.
• Availability (A:H): Code execution and/or overwriting service-relevant files can disrupt the controller and dependent ShareFile storage functions.

Business impact: ShareFile Storage Zones Controller is a component that enables on-premises ("storage zone") integration with ShareFile. Compromise of a controller can undermine the trust boundary between on-premises storage and the ShareFile cloud service, potentially exposing customer data, credentials, and internal network access. The blast radius includes any host running the affected controller, and by extension, data stored within the associated storage zone.

Exploitability context: The local attack vector and high attack complexity temper the base score to 7.4, but unauthenticated (PR:N) and no-interaction (UI:N) characteristics mean that once the required input path is reachable, no operator action is needed. Because the RCE precondition is deployment-dependent and no PoC is public, near-term exploitation likelihood is moderated — but the High impacts warrant prompt mitigation.

No CISA KEV listing and no EPSS score (not yet scored by FIRST.org) are available; no exploit-in-the-wild evidence is currently documented.

Detection Guidance

Detection for this class focuses on anomalous file-creation activity by the FileCopyService/IIS service account outside expected temporary directories, writes into IIS-served executable paths, and traversal sequences in file identifiers.

Sigma Rule

title: ShareFile Storage Zones Controller FileCopyService Path Traversal File Write
id: 3b7c9a12-8f4e-4c2b-9d61-0a1f2e3d4c5b
status: experimental
description: Detects file creation by the FileCopyService/IIS service account into unexpected or IIS-served locations consistent with CVE-2026-93695 path traversal in Progress ShareFile Storage Zones Controller.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-93695
author: valtersit.com
date: 2026/01/01
logsource:
  category: file_event
  product: windows
detection:
  selection_parent:
    Image|endswith:
      - '\FileCopyService.exe'
      - '\w3wp.exe'
  selection_write:
    TargetFilename|contains:
      - '..\'
      - '../'
  selection_iis_dirs:
    TargetFilename|contains:
      - '\inetpub\'
      - '\wwwroot\'
      - '\Scripts\'
      - '\Bin\'
  condition: selection_parent and (selection_write or selection_iis_dirs)
fields:
  - Image
  - TargetFilename
  - User
falsepositives:
  - Legitimate application deployments writing to IIS directories
level: high

YARA Rule

rule CVE_2026_93695_ShareFile_PathTraversal
{
    meta:
        description = "Detects traversal sequences in file identifiers associated with ShareFile Storage Zones Controller FileCopyService (CVE-2026-93695)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-93695"
        date = "2026-01-01"
        severity = "high"

    strings:
        $traversal_win = "..\\" ascii wide
        $traversal_nix = "../" ascii wide
        $svc           = "FileCopyService" ascii wide
        $zones         = "StorageZones" ascii wide

    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x464C457F) and
        (any of ($traversal_win, $traversal_nix)) and
        $svc
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-93695 ShareFile StorageZones FileCopyService Path Traversal Attempt"; flow:established,to_server; http.uri; content:"../"; nocase; http.header; content:"ShareFile"; nocase; reference:cve,2026-93695; classtype:attempted-admin; sid:202693695; rev:1;)

Elastic Detection

file where process.name in ("FileCopyService.exe", "w3wp.exe") and
  file.path : ("*\\inetpub\\*", "*\\wwwroot\\*", "*\\Scripts\\*") and
  not file.path : ("*\\Temp\\*")

Splunk SPL Query

index=windows source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| search (Image="*\\FileCopyService.exe" OR Image="*\\w3wp.exe")
| where match(TargetFilename, "(?i)(inetpub|wwwroot|Scripts|Bin)")
| table _time, host, User, Image, TargetFilename, ProcessGuid
| sort - _time

Wazuh OSSEC Rule

<group name="windows,sysmon,cve-2026-93695,">
  <rule id="202693" level="12">
    <if_sid>61613</if_sid>
    <field name="win.eventdata.image">FileCopyService.exe|w3wp.exe</field>
    <field name="win.eventdata.targetFilename">\.\.\\|inetpub\\|wwwroot\\</field>
    <description>CVE-2026-93695: Possible ShareFile StorageZones FileCopyService path traversal file write into IIS-served path.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Affected versions: ShareFile Storage Zones Controller v5.12.6 and below.

1. Immediate mitigations

   • Restrict network exposure of Storage Zones Controller management/communication interfaces to trusted networks only; do not expose the controller directly to the internet.
   • Enforce least-privilege on the service account: remove write access to executable, IIS-served directories. Ensure the temp write location is the only writable path for FileCopyService.
   • Apply filesystem ACLs so IIS-served directories (e.g., wwwroot, Scripts, Bin) are not writable by the service account.
   • Monitor and alert on file creation by FileCopyService/IIS in executable directories (see Detection Guidance).

2. Patch / upgrade steps

   • No vendor patch is available as of this report. Monitor Progress/ShareFile security advisories for a fixed Storage Zones Controller release and upgrade immediately when issued.
   • Validate the fixed version against the vendor advisory before deployment to confirm it addresses CVE-2026-93695.

3. Long-term hardening

   • Enforce secure path-canonicalization and containment checks in any custom or integated file-handling code touching controller temp paths.
   • Adopt application allowlisting / code-integrity policies (e.g., WDAC, AppLocker) for IIS-served directories to blunt webshell/RCE drop attacks.
   • Segment storage-zone hosts from sensitive internal networks and apply egress filtering.
   • Maintain inventory of data-center connectors and controllers; remove unsupported or end-of-life versions.

References

• NVD — CVE-2026-93695: https://nvd.nist.gov/vuln/detail/CVE-2026-93695
• CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): https://cwe.mitre.org/data/definitions/22.html
• Progress ShareFile Security Advisories / Product Security: https://www.progress.com/security
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (no listing for CVE-2026-93695 at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, or evidence of in-the-wild exploitation (threat actor campaigns, CISA KEV listing) was identified at the time of writing. EPSS has not yet scored this CVE.