Description

Relative path traversal in Microsoft PowerShell Core allows an unauthorized attacker to execute code over a network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-11T17:19:11.397Z",
  "pubdate": "2026-08-11T17:19:11.397Z",
  "executiveSummary": "A relative path traversal vulnerability has been identified within Microsoft PowerShell Core, presenting a severe security risk to affected systems.\nThis vulnerability allows an unauthorized remote attacker to achieve arbitrary code execution over a network without requiring prior authentication or user interaction.\nThe flaw stems from improper input validation and sanitization of file paths processed by the application, enabling threat actors to traverse outside of intended directory boundaries.\nSuccessful exploitation compromises the confidentiality, integrity, and availability of the underlying host system, as attackers can execute arbitrary commands or scripts in the context of the running PowerShell process.\nThe risk implications are critical, potentially leading to full system compromise, lateral movement within the network, and deployment of secondary payloads.\nGiven the network-accessible vector and the absence of authentication requirements, immediate remediation is vital to prevent active exploitation of vulnerable instances.",
  "technicalDetails": "The vulnerability resides in the file path handling mechanisms of Microsoft PowerShell Core, specifically within the component responsible for parsing and resolving relative file paths provided via network inputs.\nThe root cause is insufficient sanitization of path sequences, such as dot-dot-slash (../) patterns, allowing input parameters to manipulate directory traversal logic.\nAn unauthenticated attacker across a network can craft a malicious payload containing relative path traversal sequences directed at the vulnerable component.\nWhen PowerShell Core processes the malicious input, it fails to restrict the file operations or resource loading to the designated secure root directory.\nConsequently, the application accesses or executes arbitrary files outside the intended sandbox or working directory based on the attacker's supplied path.\nThe attack flow proceeds as follows: First, the attacker identifies a network-exposed endpoint or interface within Microsoft PowerShell Core that processes file paths or module loading requests. Second, the attacker transmits a specially crafted request embedding relative path traversal directives designed to target executable resources or sensitive system files. Third, the parsing engine resolves the manipulated path, bypassing intended security boundaries due to the absence of robust canonicalization checks. Fourth, the system reads or executes the targeted resource.\nDepending on the specific implementation context, this traversal facilitates remote code execution by allowing attackers to plant or invoke arbitrary scripts directly through the abused file resolution routine.\nExploitation requires network exposure of the vulnerable Microsoft PowerShell Core service and does not mandate any specific user privileges or pre-existing authentication credentials.\nPost-exploitation impact includes arbitrary command execution with the privileges of the PowerShell process, potential escalation of privileges, data exfiltration, and persistent access across the network infrastructure."
}