CVE-2025-60722: Microsoft OneDrive Privilege Escalation

CVE-2025-60722 Overview

CVE-2025-60722 is a path traversal vulnerability in Microsoft OneDrive for Android. The flaw stems from improper limitation of a pathname to a restricted directory [CWE-22]. An authenticated attacker can exploit the weakness over a network to elevate privileges on affected devices.

The vulnerability affects the integrity of the OneDrive Android application by allowing files to be written or accessed outside their intended directory scope. Microsoft published the advisory on November 11, 2025, and has issued guidance through the Microsoft Security Response Center.

Critical Impact
An authorized attacker can traverse the OneDrive for Android file path boundaries to elevate privileges, compromising the integrity of files within the application's sandbox.

Affected Products

Microsoft OneDrive for Android
Android devices with vulnerable OneDrive client installed
Environments relying on OneDrive mobile sync for enterprise data

Discovery Timeline

2025-11-11 - CVE-2025-60722 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60722

Vulnerability Analysis

The vulnerability is a path traversal weakness classified under [CWE-22]. The OneDrive for Android application fails to properly validate or canonicalize file path inputs before using them in file system operations. An authenticated attacker with low privileges can supply crafted path strings containing traversal sequences to reach directories outside the intended scope.

Successful exploitation impacts integrity, allowing an attacker to write to or modify files outside the OneDrive sandbox. Confidentiality and availability remain unaffected according to the vector. The attack occurs over a network, meaning the attacker does not require physical or local access to the target device.

Root Cause

The root cause is insufficient sanitization of pathname components processed by the OneDrive Android client. When the application handles file references, it does not adequately reject or normalize sequences such as ../ that navigate outside the restricted directory. This allows attacker-controlled input to reference arbitrary locations accessible to the OneDrive process.

Attack Vector

Exploitation requires the attacker to hold valid low-privilege credentials to interact with the OneDrive service. The attacker sends crafted file operation requests over the network containing traversal payloads. When the vulnerable Android client processes the request, it resolves the path outside the intended directory boundary, enabling the attacker to overwrite or plant files that lead to privilege elevation within the app context.

No public proof-of-concept exploit is available at the time of this writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-60722

Indicators of Compromise

File system artifacts in the OneDrive application data directory containing unexpected files placed outside standard subfolders.
Network requests to OneDrive sync endpoints containing encoded traversal sequences such as ..%2F or %2e%2e%2f.
Unexpected modifications to OneDrive configuration files or cache entries on Android devices.

Detection Strategies

Inspect mobile device management (MDM) logs for anomalous OneDrive file operations that reference paths outside the app sandbox.
Monitor network traffic to and from OneDrive endpoints for path parameters containing traversal characters.
Correlate authentication events with subsequent file access anomalies to identify credential-based exploitation attempts.

Monitoring Recommendations

Enable audit logging on Microsoft 365 tenants for OneDrive file activity and review for anomalous access patterns.
Track Android application version compliance across enrolled devices to identify unpatched OneDrive installations.
Establish alerting thresholds for unusual file write volumes originating from mobile OneDrive clients.

How to Mitigate CVE-2025-60722

Immediate Actions Required

Update the OneDrive for Android application to the latest version available through the Google Play Store.
Enforce mobile device compliance policies that require the patched OneDrive version before granting access to corporate data.
Rotate credentials for accounts suspected of being used by unauthorized parties to access OneDrive.

Patch Information

Microsoft has released updated guidance and a fixed version of the OneDrive Android client. Refer to the Microsoft Security Update Guide CVE-2025-60722 for the specific patched version and deployment instructions.

Workarounds

Restrict OneDrive mobile access through Conditional Access policies until all devices have received the update.
Require multi-factor authentication for OneDrive sign-in to reduce the risk of authenticated exploitation by attackers using stolen credentials.
Use MDM policies to block outdated versions of the OneDrive Android application from accessing tenant resources.

bash

# Example Intune compliance policy check for minimum OneDrive version
# Configure through the Microsoft Intune admin center:
# Devices > Compliance policies > Android > App version compliance
# Set minimum version for com.microsoft.skydrive to the patched release
# listed in the Microsoft Security Update Guide for CVE-2025-60722