Description

Relative path traversal in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-11T17:18:37.327Z",
  "pubdate": "2026-08-11T17:18:37.327Z",
  "executiveSummary": "A relative path traversal vulnerability exists within Microsoft Office SharePoint, enabling an authorized adversary to achieve unauthorized information disclosure across a network vector. The vulnerability stems from improper neutralization of user-supplied input or resource identifiers, which allows navigation outside of intended directory boundaries within the application file structure.\nThe primary impact of successful exploitation is the unauthorized retrieval of sensitive data stored on the underlying host system, potentially compromising confidentiality. The affected product is Microsoft Office SharePoint. Exploitation requires the attacker to possess authorization within the system, implying that access control boundaries are bypassed or abused via crafted input sequences.\nRisk implications include the exposure of internal system configurations, application source files, or sensitive enterprise data accessible to the SharePoint process. Attacker capabilities are restricted to information disclosure; however, the retrieved data can be leveraged for subsequent reconnaissance and advanced multi-stage attacks. Exploitation prerequisites include network connectivity to the vulnerable SharePoint instance and valid credentials or an established session to satisfy the authorization requirement.\nDefensive posture requires strict validation of path inputs and adherence to secure coding principles regarding file system access operations.",
  "technicalDetails": "The vulnerability is a relative path traversal flaw residing in Microsoft Office SharePoint. The root cause originates from inadequate input sanitization and validation of parameters utilized in file system operations or resource resolution routines. Specifically, the application fails to properly filter directory navigation sequences, such as dot-dot-slash patterns, allowing malicious requests to traverse the directory hierarchy.\nThe vulnerable component handles file retrieval or internal resource referencing within the SharePoint architecture. Network exposure is present as the application is accessible over a network, permitting remote interactions. The authentication requirement specifies that the attacker must be an authorized user, meaning anonymous exploitation is not applicable under the baseline conditions. Privilege requirements dictate that the attacker possesses standard user authorization, which is then leveraged to access unauthorized resources outside the designated privilege domain.\nThe attack flow proceeds as follows: First, the authorized attacker formulates a malicious HTTP request or protocol interaction containing relative path traversal sequences targeting a specific sensitive file on the server. Second, the request is transmitted over the network to the vulnerable Microsoft Office SharePoint endpoint. Third, the vulnerable component processes the input without sufficiently neutralizing the traversal sequences, resolving the path relative to the application root rather than the restricted directory.\nFourth, the file system subsystem retrieves the targeted file based on the manipulated path. Finally, the contents of the sensitive file are encapsulated in the server response and returned to the attacker, resulting in unauthorized information disclosure. Payload behavior is passive regarding system modification, focusing entirely on data exfiltration. Post-exploitation impact is characterized by the harvesting of internal data structures, credentials, or configuration parameters, which facilitates lateral movement or escalation of privileges in subsequent attack phases."
}