Path traversal in Microsoft SharePoint Server - CVE-2026-70298
Published: October 14, 2026
Vulnerability identifier: #VU154717
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-70298
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to path traversal in Microsoft Office SharePoint when accessing the file system over a network. A remote user can read files outside the restricted directory to disclose sensitive information.
The Preview Pane is not an attack vector for this vulnerability.
Affected software
Microsoft SharePoint Server
How to mitigate CVE-2026-70298
Install security update from vendor's website.
Microsoft SharePoint Server - update to 16.0.20326.20190