Description

In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file identifier when constructing a local temporary file path without enforcing containment. This can cause FileCopyService to write attacker-controlled content to filesystem locations writable by the service account. This can result in remote code execution when an executable IIS-served directory is writable.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-10-12T13:17:33.590Z",
  "pubdate": "2026-10-12T13:17:33.590Z",
  "executiveSummary": "This vulnerability is a path traversal flaw residing within the ShareFile Storage Zones Controller, specifically impacting versions 5.12.6 and below. The vulnerability stems from improper validation of file identifiers within the FileCopyService component, which allows for unauthorized filesystem write operations.\nBy manipulating remote file identifiers, an unauthenticated or authenticated attacker can force the application to write arbitrary content to arbitrary locations on the host filesystem, provided the service account possesses the necessary write permissions.\nThe primary risk implication is Remote Code Execution (RCE). If an attacker targets an executable directory served by Internet Information Services (IIS), they can plant malicious scripts or binaries, leading to full system compromise.\nThe exploitation requirement involves the ability to reach the affected service and supply a crafted file identifier. Given the nature of ShareFile deployments, this often involves exposure of the Storage Zones Controller to the network. Organizations should prioritize patching, as this vulnerability represents a high-severity entry point for complete infrastructure takeover.",
  "technicalDetails": "The vulnerability exists within the FileCopyService of the ShareFile Storage Zones Controller. The root cause is a lack of path normalization and containment enforcement when processing remote file identifiers.\nThe application relies on user-supplied input to construct the local destination path for temporary files. Because the software fails to sanitize the identifier or validate that the resulting path remains within a restricted, sandbox-like directory, it is susceptible to directory traversal attacks using sequences such as '../'.\nThe attack flow begins when an attacker invokes the FileCopyService with a maliciously crafted remote file identifier. This identifier contains traversal sequences that escape the intended base directory. The service, operating under the privileges of the web service account, interprets this path as a legitimate target.\nConsequently, the FileCopyService writes attacker-controlled payload content to an arbitrary location on the server's disk. The impact is dictated by the write permissions of the service account. If the account has write access to directories mapped as executable within IIS (e.g., bin directories, web roots, or virtual directories configured to allow script execution), the attacker can successfully drop a webshell or other executable code.\nOnce the file is written to an executable location, the attacker can trigger the payload by sending a standard HTTP request to the newly created file. Because the payload is served and executed by the IIS worker process, the attacker achieves remote code execution in the context of the service account. This allows for further post-exploitation activities, including credential harvesting, lateral movement, or complete system takeover.\nThe vulnerability affects all versions of ShareFile Storage Zones Controller 5.12.6 and below. Successful exploitation does not inherently require complex bypasses if the service is directly reachable. The mechanism is a classic 'Write-What-Where' scenario resulting from inadequate input validation and path isolation logic within the internal file handling routines."
}