Path Traversal Vulnerability in .NET Framework by Microsoft
CVE-2026-70161

7.3HIGH

Key Information:

Vendor

Microsoft
Status
.net 10.0 Runtime
.net 11.0 Runtime
.net 9.0 Runtime
Microsoft Visual Studio 2022 Version 17.14
Vendor
CVE Published:
13 October 2026

What is CVE-2026-70161?

A path traversal vulnerability in .NET allows an authorized attacker to exploit improper limitations of a pathname, potentially enabling them to gain elevated privileges on local systems. This issue may lead to unauthorized access to sensitive files and execution of malicious actions, posing significant risks to system integrity and security.

Affected Version(s)

.NET 10.0 runtime 10.0.0 < 10.0.402

.NET 11.0 runtime 11.0.0 < 11.0.100-rc.2

.NET 9.0 runtime 9.0.0 < 9.0.319, 9.0.122

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.