An absolute path traversal vulnerability exists in Microsoft Skype for Business Server, allowing an authorized user to reference directories outside the intended area and thereby elevate privileges within the network. Identified as CWE‑36, this flaw permits an attacker with non‑privileged access to abuse file‑path handling to bypass designed security boundaries, potentially accessing or modifying restricted resources.

Microsoft’s Skype for Business Server 2015 CU13, Skype for Business Server 2019 CU8, and Skype for Business Server Subscription Edition CU1 are affected. The specific cumulative update releases listed contain the path traversal issue.

The CVSS score of 8.1 indicates a high severity risk. Exploitation requires an authenticated user within the organization’s network to craft a traversal request; the EPSS score is 1%, and the vulnerability is not yet listed in CISA’s KEV catalog, suggesting that no widely known exploits exist as of now. The likely attack vector is local authorized access, where an attacker with valid credentials directs the Skype for Business service to resolve an arbitrary file path that escapes the intended directory.