In Progress ShareFile Storage Zones Controller version 5.12.6 and earlier, the system processes queue items that can send acknowledgements to an unvalidated callback URL. An attacker who can inject items into the copy queue and trigger a race condition can cause the FileCopyService to consume attacker‑controlled metadata and content, potentially allowing modification or injection of data.

Progress ShareFile Storage Zones Controller v5.12.6 and earlier are affected. Products are provided by Progress and include the ShareFile Storage Zones Controller. The vulnerability applies to all releases up to version 5.12.6 inclusively.

With a CVSS score of 4, the vulnerability is of moderate severity. The EPSS score is not available and it is not listed in the CISA KEV catalog. Exploitation requires the attacker to have control over the copy queue work and to trigger a race condition, so it is not a readily exploitable remote vulnerability. The likely attack vector is an internal attacker or one who compromises the service environment and can inject malicious queue items; this is inferred from the need to manipulate queue items and race conditions.