CVE-2026-70161: .NET Path Traversal Privilege Escalation

CVE-2026-70161 Overview

CVE-2026-70161 is a path traversal vulnerability in Microsoft .NET that allows an authorized local attacker to elevate privileges. The flaw stems from improper limitation of a pathname to a restricted directory, classified under [CWE-22]. An attacker with low privileges can craft input containing directory traversal sequences to access or write files outside the intended scope. Successful exploitation requires user interaction and results in high impact to confidentiality, integrity, and availability. Microsoft published the advisory on October 13, 2026.

Critical Impact
Local privilege escalation in .NET through path traversal, enabling an authorized attacker to compromise confidentiality, integrity, and availability of the host.

Affected Products

Microsoft .NET (refer to the Microsoft Security Update Guide for specific affected versions)
Applications built on vulnerable .NET runtime versions
Systems running .NET SDK components on Windows, Linux, or macOS where applicable

Discovery Timeline

2026-10-13 - CVE-2026-70161 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-70161

Vulnerability Analysis

The vulnerability resides in how .NET validates and canonicalizes file path inputs. An authorized local attacker supplies a pathname containing traversal sequences such as ../ or encoded equivalents. The runtime fails to properly restrict resolution within the intended directory boundary. This allows the attacker to reference files outside the restricted scope.

Exploitation requires local access, low privileges, and user interaction. When the vulnerable code path executes under a higher-privileged context, the attacker gains access to resources normally outside their reach. The impact extends to reading sensitive files, overwriting system binaries, or placing files that lead to code execution with elevated privileges.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The affected .NET component does not consistently normalize path separators, resolve relative segments, or verify that the final resolved path remains within the allowed base directory before performing file operations.

Attack Vector

The attack vector is local. An attacker needs valid credentials on the target system and must induce a user to perform an action, such as opening a crafted file or application. The crafted input traverses outside the intended directory, enabling privileged file read or write operations.

The vulnerability manifests when .NET APIs resolve attacker-controlled paths
without enforcing canonicalization against an allow-listed base directory.
See the Microsoft Security Update Guide for technical details:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70161

Detection Methods for CVE-2026-70161

Indicators of Compromise

File access or creation events in system directories originating from .NET processes running under unexpected user contexts.
Presence of files containing traversal sequences such as ..\\ or %2e%2e%2f in application input logs.
Unexpected modification timestamps on binaries or configuration files within protected directories.

Detection Strategies

Audit file system telemetry for .NET host processes (dotnet.exe, dotnet) performing writes outside their working directory.
Correlate process command-line arguments and file open events to identify traversal patterns in path parameters.
Monitor Windows Event Logs and Linux audit records for privilege-sensitive file operations performed by non-privileged users through .NET applications.

Monitoring Recommendations

Enable file integrity monitoring on operating system directories, application install paths, and startup locations.
Track .NET runtime versions deployed across the environment to prioritize patch coverage.
Alert on anomalous child-process creation or DLL loading triggered by .NET applications after file write events.

How to Mitigate CVE-2026-70161

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide for all affected .NET versions.
Inventory systems with vulnerable .NET runtimes and SDKs, prioritizing hosts that run privileged .NET services.
Restrict interactive logon rights on sensitive systems to reduce the pool of users able to trigger local exploitation.

Patch Information

Microsoft has published guidance for CVE-2026-70161 through the Security Update Guide. Administrators should review the advisory for the list of fixed runtime and SDK versions and deploy updates through Windows Update, package managers, or the official .NET installers. Rebuild and redeploy self-contained .NET applications to incorporate the patched runtime.

Workarounds

Validate and canonicalize all user-supplied path inputs in .NET applications using Path.GetFullPath combined with explicit base-directory checks.
Run .NET services under least-privilege accounts to limit the impact of successful traversal.
Apply application allow-listing and restrict write permissions on directories used by .NET workloads until patches are applied.

bash

# Verify installed .NET runtime versions and update
dotnet --list-runtimes
dotnet --list-sdks
# Then install the patched runtime per Microsoft advisory guidance