CVE-2026-45454: SharePoint Server Upload.aspx Path Traversal Leads to Remote Code Execution

Vulnerability Overview

SharePoint Server's file‑upload page (Upload.aspx) parses the RootFolder query parameter without verifying that the resolved folder belongs to the document library identified by the List parameter. An attacker with Contribute rights to any library can set List to a permitted library and RootFolder to a folder in a different, restricted library (e.g., _catalogs/masterpage), bypassing permission checks.

If the SharePoint web application is configured with a <PageParserPath> that allows server‑side script execution in the master‑page gallery, the attacker can upload an ASPX webshell, which is compiled and run under the w3wp.exe application‑pool identity, achieving remote code execution.

Vulnerability Type and Severity

CWE‑22: Improper Restriction of XML Path Elements (Path Traversal)

CVSS v3.1: 6.5 (Medium) – Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

AretiQ CVSS v4.0 assessment: 8.2 (High) – Vector: AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N/E:P

Affected Products

Microsoft SharePoint Server 2019 (KB5002874)

Microsoft SharePoint Enterprise Server 2016 (KB5002880)

Microsoft SharePoint Server Subscription Edition (KB5002873)

Root‑Cause Analysis

How the Vulnerability Works

Upload.aspx receives two query parameters:

List : GUID of the target document library (used for permission checks).

RootFolder : Server‑relative URL of the target folder.

The CurrentList property resolves List to an SPDocumentLibrary object, and CurrentFolder calls SPWeb.GetFolder(RootFolder) to obtain an SPFolder. The original code performed no ownership check, allowing any valid folder URL to be used regardless of the library.

// UploadPage.CurrentFolder (pre‑patch)
protected SPFolder CurrentFolder
{
    get
    {
        if (m_folder == null)
        {
            // RootFolder resolved via GetFolder – no ownership check
            m_folder = PrivateWeb.GetFolder(CurrentFolderServerRelativeUrl);
        }
        return m_folder;
    }
}

During file upload, OnSubmit() adds the file to CurrentFolder.Files, which may point outside the authorized library.

Patch Fix

The patch adds two validations in the CurrentFolder getter:

Throws an exception if CurrentList is null.

Verifies that m_folder.ParentListId == CurrentList.ID, rejecting traversal attempts.

// UploadPage.CurrentFolder (post‑patch)
protected SPFolder CurrentFolder
{
    get
    {
        if (m_folder == null)
        {
            // New: empty list check
            if (CurrentList == null)
                throw new ArgumentException("RootFolder parameter is being resolved but no target list is set.");
            m_folder = PrivateWeb.GetFolder(CurrentFolderServerRelativeUrl);
            // New: parent‑list ownership check
            if (m_folder.ParentListId != CurrentList.ID)
                throw new ArgumentException("Possible folder traversal attempt.");
        }
        return m_folder;
    }
}

Impact

Level 1 – Unconditional: Any authenticated user with Contribute rights can upload arbitrary files to any other library, even without explicit permission.

Level 2 – Conditional (RCE): When

<PageParserPath path="/_catalogs/masterpage/*" allowServerSideScript="true">

is enabled, an ASPX webshell can be uploaded and executed, allowing the attacker to run OS commands as the application‑pool identity.

RCE Attack Chain

Attacker has Contribute rights on a source library (e.g., "Documents").

Send

GET Upload.aspx?List={Docs_GUID}&RootFolder=/_catalogs/masterpage

.

POST an ASPX webshell to the same URL (traversal upload).

File lands in /_catalogs/masterpage/webshell.aspx.

Request GET /_catalogs/masterpage/webshell.aspx?cmd=whoami.

SharePoint compiles the ASPX and executes it server‑side.

Output shows the application‑pool identity.

Reproduction Steps

Path‑Traversal PoC

Prerequisites: vulnerable SharePoint Server (e.g., SP2019 test), two libraries, Python 3.10+ with requests and requests_ntlm.

Run:

uv run exploit_upload_traversal.py --target http://sharepoint.example.com --user DOMAIN\user --password

.

The script obtains the source library GUID, crafts the malicious RootFolder, uploads a file, and verifies its presence in the target library.

Remote Code Execution PoC

Additional requirement: web.config contains

<PageParserPath path="/_catalogs/masterpage/*" includeSubFolders="true" allowServerSideScript="true" />

.

Run:

uv run exploit_rce_masterpage.py --target http://sharepoint.example.com --user DOMAIN\user --password --source-lib Documents --payload canary

(or --payload inline --cmd "whoami & hostname").

Detection

Network Detection (Suricata)

# Detect SharePoint Upload.aspx traversal to master page gallery
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2026-45454 SharePoint Upload Path Traversal to Master Page Gallery"; 
  flow:to_server,established; 
  content:"Upload.aspx"; http_uri; 
  content:"List="; http_uri; 
  content:"RootFolder="; http_uri; 
  content:"_catalogs"; http_uri; 
  reference:cve,CVE-2026-45454; 
  classtype:web-application-attack; 
  sid:2026454541; rev:2;)

# Broader detection for suspicious RootFolder values
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2026-45454 SharePoint Upload Path Traversal - suspicious RootFolder"; 
  flow:to_server,established; 
  content:"Upload.aspx"; http_uri; 
  content:"List="; http_uri; 
  content:"RootFolder="; http_uri; 
  pcre:"/RootFolder=[^&]*(?:\/[A-Z][^\/&]+)/Ui"; 
  reference:cve,CVE-2026-45454; 
  classtype:web-application-attack; 
  sid:2026454542; rev:1;)

Host Detection

PowerShell script to check the version and hash of microsoft.office.policy.pages.dll and compare against known vulnerable ranges.

PowerShell command to verify installed KBs ( KB5002874, KB5002880).

ULS log monitoring for tags 495502806 (“Possible folder traversal attempt”) and 495502807 (“RootFolder parameter is being resolved but no target list is set”).

Get-Content "C:\Program Files\Common Files\microsoft shared\Web Server Extensions\16\LOGS\*.log" |
  Select-String "49550280[67]"

References

Microsoft Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45454

MITRE CVE entry: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45454

NVD details: https://nvd.nist.gov/vuln/detail/CVE-2026-45454

KB5002874 (SharePoint 2019 fix): https://support.microsoft.com/help/5002874

KB5002880 (SharePoint 2016 fix): https://support.microsoft.com/help/5002880