The vulnerability is a path‑traversal flaw that allows an authorised attacker to supply a pathname that escapes the intended restricted directory. By doing so, the attacker can place and then execute arbitrary code on the SharePoint server, resulting in full control over the affected system.

Microsoft SharePoint Server Subscription Edition is affected. No specific version information was provided.

The flaw carries a CVSS score of 8.8, indicating a high severity. EPSS data is unavailable, and the vulnerability has not yet entered the CISA Known Exploited Vulnerabilities catalogue. The attack vector is inferred to be network‑based, requiring the attacker to be authenticated within the SharePoint environment. Once the authorisation is achieved, the path traversal can be exploited to run code remotely.