CVE-2026-108452
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
A path traversal vulnerability in Microsoft Office SharePoint is caused by improper limitation of a pathname to a restricted directory. An authorized attacker can execute code over a network.
Risk Assessment
An attacker with valid credentials can exploit this to remotely execute code on the SharePoint server. This may lead to system compromise and data leakage.
Recommendation
Apply the latest security updates for Microsoft Office SharePoint. Restrict user privileges and monitor for unusual file requests.
Other vulnerabilities in Microsoft Office SharePoint
See all- CVE-2026-40368High
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- CVE-2026-40357High
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- CVE-2026-35439High
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- CVE-2026-33112High
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- CVE-2026-33110High
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- CVE-2026-20951High
Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.
- CVE-2026-20947High
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- CVE-2026-70306Critical
A cross-site scripting vulnerability in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
- CVE-2026-65660HighActively exploited
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- CVE-2026-70332Critical
Improper input neutralization during web page generation (cross-site scripting) in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
Original NVD description (English source)
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS