In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL…
In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition allows the attacker to cause FileCopyService to consume attacker-controlled metadata and content. Exploitation requires control over copy queue work and a race condition.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Citrix
- Product
- ShareFile
- CVSS
- 4.0
- Exposure class
- File transfer
Why it ranks 21 (Routine)
- CVSS 4.0 medium
- Exposed product class: file transfer
- Widely deployed vendor product (Citrix)
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-93694 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.