CVE-2026-123973
SharePoint Products CopyMove before 2026-11-06 allows traversal
- Risk score
- 40/100
- CVSS
- 5.0 v3.1
- Published
- 6 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- SharePoint Products CopyMove before 2026-11-06 allows traversal. An authenticated SharePoint user with the necessary permissions to use the ZIP import functionality may exploit a path traversal vulnerability in CopyMove for SharePoint 2019 and CopyMove for SharePoint V6 by supplying a crafted ZIP archive. A path trave…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 5.0 medium
- On your watchlist: sharepoint
References
Original description
SharePoint Products CopyMove before 2026-11-06 allows traversal. An authenticated SharePoint user with the necessary permissions to use the ZIP import functionality may exploit a path traversal vulnerability in CopyMove for SharePoint 2019 and CopyMove for SharePoint V6 by supplying a crafted ZIP archive. A path traversal vulnerability in the ZIP import functionality of SharePoint Products ApS CopyMove for SharePoint 2019 and CopyMove for SharePoint V6 allows a user with access to the ZIP import functionality to supply a crafted ZIP archive containing malicious entry paths. During extraction, these paths may cause files to be written outside the intended extraction directory. The issue has been addressed by implementing ZIP archive entry path validation to prevent extraction outside the designated directory.
Last activity 6 Nov 2026. Patch Forecast updates every hour.