CVE-2026-54108: SharePoint Server Path Traversal Flaw

CVE-2026-54108 Overview

CVE-2026-54108 is a spoofing vulnerability in Microsoft Office SharePoint caused by external control of a file name or path [CWE-73]. An authenticated attacker with low privileges can manipulate file path inputs to perform spoofing attacks over the network. The flaw affects multiple supported SharePoint Server releases, including Subscription Edition, 2019, and 2016. Microsoft published the advisory on July 14, 2026, and assigned a CVSS 3.1 base score reflecting confidentiality impact only, with no direct effect on integrity or availability.

Critical Impact
An authorized attacker can exploit externally controlled file paths to spoof trusted SharePoint resources, potentially exposing sensitive content stored in the affected server.

Affected Products

Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Server 2019
Microsoft SharePoint Server 2016 Enterprise

Discovery Timeline

2026-07-14 - CVE-2026-54108 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-54108

Vulnerability Analysis

The vulnerability stems from improper handling of externally controlled file names or paths within Microsoft Office SharePoint Server. An authenticated user can supply crafted path or file name input that SharePoint uses without adequate validation. This allows the attacker to reference or reference-mimic resources outside the intended scope, producing a spoofing condition perceived as legitimate by other users or downstream components.

The attack targets the confidentiality of resources accessible through SharePoint. Because the CVSS vector indicates no impact on integrity or availability, exploitation focuses on inducing the server or clients to disclose or trust content that appears to originate from a different, trusted location. The CWE-73 classification (External Control of File Name or Path) confirms the root category of insecure input handling for file path parameters.

The EPSS probability is 0.713% at the 49th percentile, indicating moderate near-term exploitation likelihood relative to other published CVEs. No public proof-of-concept, exploit code, or in-the-wild exploitation has been observed at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

SharePoint accepts file path or file name parameters from an authenticated user and incorporates them into resource resolution logic without sufficient normalization or trust boundary enforcement. This lets an attacker influence which file or URL is referenced in server-generated content, enabling a spoofed representation to be delivered over the network.

Attack Vector

Exploitation requires network access to the SharePoint site and valid low-privilege credentials. No user interaction is required. The attacker submits crafted requests containing manipulated path or file name values, and the SharePoint server processes these values in a way that surfaces spoofed content to other users or systems.

No verified public exploitation code is available for CVE-2026-54108. Refer to the Microsoft Vulnerability Advisory for authoritative technical details.

Detection Methods for CVE-2026-54108

Indicators of Compromise

SharePoint request logs containing unusual path traversal sequences, URL-encoded separators, or file name parameters referencing unexpected locations.
Authenticated user sessions submitting file or path parameters that resolve outside their normal working scope or document libraries.
Anomalous rendering of links or file references in SharePoint pages that point to inconsistent hostnames or unexpected file extensions.

Detection Strategies

Monitor IIS and SharePoint Unified Logging Service (ULS) logs for requests where user-controlled input maps directly to file path parameters.
Correlate authentication events with subsequent access to atypical file paths or resources to identify low-privilege accounts probing for spoofing conditions.
Baseline normal SharePoint API and document handling patterns, then alert on statistical deviations in file path parameter values.

Monitoring Recommendations

Enable verbose ULS logging for content publishing and document handler components on affected SharePoint Server versions.
Forward SharePoint, IIS, and Windows Security event logs to a centralized analytics platform for correlation across sessions and users.
Alert on any authenticated request patterns that combine low-privilege accounts with parameters resembling absolute paths, UNC paths, or crafted URLs.

How to Mitigate CVE-2026-54108

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Vulnerability Advisory to all affected SharePoint Server instances.
Inventory SharePoint Server Subscription Edition, 2019, and 2016 deployments and prioritize internet-exposed farms for immediate patching.
Review recent authentication logs and audit low-privilege accounts for suspicious file path submissions before patching.

Patch Information

Microsoft has released security updates for the affected SharePoint Server versions. Administrators should install the vendor-supplied cumulative or security update as documented in the Microsoft Vulnerability Advisory. Validate patch deployment by confirming the updated build numbers on all SharePoint web front-end and application servers in the farm.

Workarounds

Restrict SharePoint site access to trusted authenticated users only, and enforce least privilege on document libraries and lists.
Place SharePoint web front-end servers behind a web application firewall configured to inspect and normalize file path and file name parameters.
Disable or restrict SharePoint features that accept user-supplied file references where they are not required for business operations.

bash

# Verify SharePoint Server patch level on Windows
Get-SPFarm | Select-Object BuildVersion
Get-SPProduct | Format-Table -AutoSize