Technical impact
The vulnerability is a path traversal flaw in Microsoft Office SharePoint that allows an attacker with authorized access to craft requests containing manipulated file paths. By bypassing the restricted directory limitation, the attacker can read content that should otherwise be inaccessible, resulting in the disclosure of sensitive data over the network. This weakness is categorized as CWE-22, "Improper Limitation of a Pathname to a Restricted Directory."
Affected Systems
The flaw impacts Microsoft SharePoint Server Subscription Edition. No specific version range is provided in the current data, so all deployed instances of this product are potentially affected until the vendor releases a patch that addresses the path traversal issue.
Risk and Exploitability
The CVSS score of 6.5 indicates a moderate severity, and the CVE is not listed in the CISA KEV catalog, suggesting that it is not known to be exploited in the wild. The EPSS score of 1% indicates a low probability of exploitation. Based on the description, the likely attack vector requires an authenticated attacker who can submit crafted URLs or file references to the SharePoint application; an unauthenticated attacker would not be able to exploit the flaw without first gaining authorized access.
