External Control of File Name or Path in Microsoft products - CVE-2025-33053
Published: June 10, 2025 / Updated: January 4, 2026
Vulnerability identifier: #VU110708
CSH Severity: Critical
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-33053
CWE-ID: CWE-73
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to incorrect processing of file path in WebDav links. A remote attacker can trick the victim into clicking on a specially crafted link and execute arbitrary code on the system.
Note, the vulnerability is being actively exploited in the wild.
Affected software
Microsoft Windows
Windows Server
Microsoft Internet Explorer
Windows Server
Microsoft Internet Explorer
How to mitigate CVE-2025-33053
Install updates from vendor's website.
Microsoft Windows - addressed in versions 10 21H2 10.0.19044.5965, 10 22H2 10.0.19045.5965, 10 1507 10.0.10240.21034, 10 1607 10.0.14393.8148, 10 1809 10.0.17763.7434, 11 22H2 10.0.22621.5472, 11 23H2 10.0.22631.5472, 11 24H2 10.0.26100.4270, 11 24H2 10.0.26100.4349
Windows Server - addressed in versions 2008 R2 6.1.7601.27769, 2008 6.0.6003.23351, 2012 R2 6.3.9600.22620, 2012 6.2.9200.25522, 2016 10.0.14393.8148, 2019 10.0.17763.7434, 2022 23H2 10.0.25398.1665, 2022 10.0.20348.3745, 2022 10.0.20348.3807, 2025 10.0.26100.4270, 2025 10.0.26100.4349
Windows Server - addressed in versions 2008 R2 6.1.7601.27769, 2008 6.0.6003.23351, 2012 R2 6.3.9600.22620, 2012 6.2.9200.25522, 2016 10.0.14393.8148, 2019 10.0.17763.7434, 2022 23H2 10.0.25398.1665, 2022 10.0.20348.3745, 2022 10.0.20348.3807, 2025 10.0.26100.4270, 2025 10.0.26100.4349
Links to Public Exploits and PoC-codes
- Exploit #12224 - CVE-2025-33053-POC (POC for CVE-2025-33053 WebDav Exploit, demonstrating how the vulnerability can be triggered in a real environment. This repository focuses on hands-on exploitation steps, reproducible test cases, and observable impact, helping security (January 4, 2026)
- Exploit #11778 - CPR-Zero: CVE-2025-33053 (July 9, 2025)
- Exploit #11732 - CVE-2025-33053 Exploit via Malicious .URL File and WebDAV (June 29, 2025)
- Exploit #11680 - CVE-2025-33053-Checker-PoC (June 20, 2025)
- Exploit #11660 - CVE-2025-33053-WebDAV-RCE-PoC-and-C2-Concept (Proof-of-Concept for CVE-2025-33053 Exploiting WebDAV with .url file delivery to demonstrate realistic remote code execution. Includes a decoy PDF payload and a video-only showcase of potential command-and-co (June 20, 2025)
- Exploit #11642 - CVE-2025-33053-Proof-Of-Concept (June 13, 2025)