CVE-2026-93694
MEDIUM
NVD
CVSS Score
4
Severity
MEDIUM
Published
Oct 12, 2026
Vendor
unknown
Description
In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition allows the attacker to cause FileCopyService to consume attacker-controlled metadata and content. Exploitation requires control over copy queue work and a race condition.