Improper limitation of a pathname to a restricted directory in Microsoft SharePoint allows an authorized attacker to execute arbitrary code via a path traversal flaw. The vulnerability can enable the attacker to run malicious code with the privileges of the affected SharePoint service, potentially compromising confidentiality, integrity, and availability of the site and underlying infrastructure.

The flaw affects Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. No specific update levels are listed, so any current installation of these products is potentially vulnerable.

The CVSS score of 6.5 indicates a moderate severity. Because the EPSS score is not available, the exploitation likelihood cannot be quantified; the vulnerability is not listed in the CISA KEV catalog. The flaw requires an authenticated user with permissions to supply a manipulated path, implying that attackers must first gain authorized access to the SharePoint environment. Once authenticated, the path traversal can be used to execute code remotely on the server.