Path Traversal Vulnerability in SharePoint Products ZIP Import Feature
CVE-2026-123973

5MEDIUM

Key Information:

Vendor

Sharepoint Products

Status
Copymove For Sharepoint V6
Copymove For Sharepoint 2019
Vendor
CVE Published:
6 November 2026

What is CVE-2026-123973?

A path traversal vulnerability exists in the ZIP import feature of SharePoint Products CopyMove, allowing an authenticated user to exploit the system by supplying a specially crafted ZIP archive. This vulnerability enables unauthorized file extraction to locations outside the designated directory, potentially compromising system integrity. The vendor has addressed this issue by implementing validation for ZIP archive entry paths to ensure that files are extracted securely within the intended boundaries.

Affected Version(s)

CopyMove for SharePoint 2019 Windows 5.0.0.0 < 5.2.1.2095

CopyMove for SharePoint V6 Windows 6.0.0.0 < 6.3.1.2094

References

https://www.sharepointproducts.com/security/advisories/zi...
vendor-advisory

CVSS V3.1

Score:
5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.