CVE-2026-93694: CWE-918: Server-Side Request Forgery (SSRF) in Progress ShareFile Storage Zones Controller

In Progress ShareFile Storage Zones Controller versions up to 5.12.6, the processing of queue items can send acknowledgements to an unvalidated callback URL. This behavior, together with a race condition, enables an attacker who controls copy queue work to cause the FileCopyService to consume attacker-controlled metadata and content. Exploitation requires control over the copy queue work and involves a race condition, making the attack complex. The vulnerability is classified as CWE-918 (Server-Side Request Forgery).

The vulnerability allows an attacker to influence the FileCopyService to consume attacker-controlled metadata and content, potentially leading to integrity and availability impacts. The CVSS score of 4.0 reflects a medium severity with limited confidentiality impact, low integrity impact, and low availability impact. There is no indication of confidentiality compromise. Exploitation requires local access and high attack complexity.

No official patch or remediation details are provided in the vendor advisory or patch links. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the copy queue work functionality and monitor for unusual activity related to queue processing. Avoid exposing callback URLs that could be manipulated by untrusted sources.