This flaw is a path traversal weakness that lets an authorized attacker reference directories outside the intended SharePoint web application root and execute code over the network. The vulnerability is classified as high impact with a CVSS score of 8.8, indicating that exploitation could allow the attacker to run arbitrary code with the privileges of the SharePoint service. The weakness is identified as CWE‑22.

Microsoft has listed the affected products as Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019 and Microsoft SharePoint Server Subscription Edition. No specific version range is supplied, but any deployment of these releases is potentially impacted.

The CVSS score signals a high severity, and the EPSS score is not available, providing no indication of current exploit prevalence. The vulnerability is not listed in the CISA KEV catalog. Because the attacker must already have some level of authorized access to SharePoint, the attack vector is most likely internal or through a compromised account. The path traversal could be leveraged to execute code with the application pool identity, compromising confidentiality, integrity, and availability of the SharePoint environment.