CVE-2026-102217
8.8
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: secure@microsoft.com (Secondary)
Description
Improper resolution of path equivalence in WebDAV allows an authorized attacker to elevate privileges over a network.
Affected (26)
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| version < 10.0.14393.9612 | |
| version < 10.0.17763.9376 | |
| version < 10.0.19044.7807 | |
| version < 10.0.19045.7807 | |
| version < 10.0.22631.7652 | |
| version < 10.0.26100.9711 | |
| version < 10.0.26200.9711 | |
| version < 10.0.28000.3231 | |
| version < 10.0.26300.9711 | |
| All versions | |
| version < 10.0.14393.9612 | |
| version < 10.0.17763.9376 | |
| version < 10.0.20348.5761 | |
| version < 10.0.26100.33650 |
Related CWEs
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-41
Improper Resolution of Path Equivalence
The product is vulnerable to file system contents disclosure through path equivalence. Path equivalence involves the use of special characters in file and directory names. The associated manipulations are intended to generate multiple names for the same object.
References (1)
Source: secure@microsoft.com
PatchVendor Advisory
Timeline
No history available yet.