Relative path traversal in the Windows Shell allows an attacker who already has local user context to perform actions with elevated privileges. The flaw arises from the Shell accepting a specially crafted path that resolves to directories outside the intended scope, effectively granting access to higher‑level resources. This behavior can be abused to replace or modify system files, thereby enabling the attacker to gain full system control. The weakness is classified as CWE‑23, a path manipulation error.

Affected products include Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2, as well as Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1. The vulnerability also impacts Windows Server editions: 2012, 2012 R2, 2016, 2019, 2022, and 2025, both full and Server Core installations.

The CVSS score of 7.8 signals a high severity flaw, and because the vulnerability requires only local user privileges, the potential for damage is significant. The EPSS score is not available, indicating uncertainty about the current exploitation window, but the absence of a KEV listing suggests there are no publicly known exploits yet. Nonetheless, the flaw can be exploited by any local user, making it a low‑barrier attack vector that could be combined with other local privilege escalation techniques to compromise the entire system.