Advisory · CVE-2026-108452
SharePoint path traversal lets a low-privilege authorized user execute code on the server
A path traversal flaw in Microsoft SharePoint Server Subscription Edition lets an authorized low-privilege attacker execute code over the network. Microsoft rates it CVSS 3.1 8.8.
- Vendor
- Microsoft
- Product
- Microsoft SharePoint Server
- Identifier / CWE
- CVE-2026-108452
CWE-22 - Action timing
- Immediate
Explain it like I’m five
SharePoint lets a signed-in user name a file path, and crafted path segments walk out of the folder SharePoint meant to confine them to, reaching places that lead to code running on the server.
- 01Attacker signs in
The attacker uses a valid low-privilege SharePoint account; no admin rights are needed.
- 02Crafted path submitted
A request carries path segments that escape the restricted directory SharePoint intended.
- 03Server-side code path reached
The traversal reaches a location where the supplied content can be executed.
- 04Code runs on the server
The attacker executes code on the SharePoint server over the network.
What happened
Microsoft disclosed CVE-2026-108452 in its October 2026 release: an improper limitation of a pathname to a restricted directory (CWE-22) in Microsoft SharePoint. Unlike the Office document flaws in the same release, this one is server-side and needs only a low-privilege authorized account, with no user interaction. Microsoft rates it CVSS 3.1 8.8.
The vendor record lists Microsoft SharePoint Server Subscription Edition before 16.0.20326.20190 as affected. Use the MSRC bulletin for the matching security update for your build.
What to do
- Inventory SharePoint Server Subscription Edition farms and confirm each server’s build against the vendor threshold.
- Apply the October 2026 SharePoint security update on every farm server, then run the configuration wizard as Microsoft directs.
- Review SharePoint and IIS logs for requests with traversal sequences and for file writes outside normal content paths.
- Audit accounts and content created outside change control, especially in the window before patching.
- Verify the farm build number after the update completes.
Management note
SharePoint has a long history as an initial-access and persistence target, and this flaw needs only an ordinary account. Server-side SharePoint patching should not wait for the client Office ring.