CVE-2026-45454 — Microsoft SharePoint ServerUpload Page Folder Path Traversal

Introduction

Microsoft SharePoint Server is the most widely deployed enterprise document management and collaboration platform, used by governments, financial institutions, and enterprises worldwide. Its permission model relies on granular per-library access controls: users may hold Contribute rights on one document library but have no access to another on the same site.

This research documents a path traversal vulnerability (CWE-22) in SharePoint Server’s Upload.aspx page, tracked as CVE-2026-45454. The UploadPage.CurrentFolder property in microsoft.office.policy.pages.dll resolves the user-supplied RootFolder query parameter via SPWeb.GetFolder() without verifying that the resolved folder belongs to the document library specified by the List parameter.

This mismatch allows an attacker to pass permission checks against a library they have access to (List) while redirecting the actual file upload to a completely different library (RootFolder) — including the sensitive _catalogs/masterpage gallery. When combined with PageParserPaths configurations that allow server-side script execution, this escalates to full Remote Code Execution.

Attack Overview

Initial Access Attacker holds Contribute permissions on any document library (e.g., “Documents”) on a SharePoint site. This is a standard permission level granted to most authenticated users.

Path Traversal Attacker crafts a request to /_layouts/15/Upload.aspx with List={Documents_GUID} (passes permission check) but RootFolder=/_catalogs/masterpage (redirects upload to Master Page Gallery).

Authorization Bypass SharePoint’s UploadPage checks AddListItems permission against the List parameter only. The CurrentFolder property resolves RootFolder via SPWeb.GetFolder() without any ownership validation — the file lands in the attacker-chosen destination.

Code Execution When PageParserPaths is configured with AllowServerSideScript="true" for /_catalogs/masterpage/*, the uploaded ASPX webshell is compiled and executed server-side by SharePoint, running arbitrary OS commands as the w3wp.exe application pool identity.

Why is PageParserPaths commonly enabled?

SharePoint deployments with custom branding, custom master pages, or third-party design packages frequently configure PageParserPaths in web.config to allow server-side code in the Master Page Gallery. This is a documented Microsoft configuration pattern for enabling custom code-behind in content database pages. Many production SharePoint farms have this setting enabled.

What about SharePoint SafeMode?

SharePoint’s SafeMode page parser blocks inline code blocks (<% %>, <script runat="server">) in pages stored in the content database by default. However, the PageParserPaths configuration explicitly overrides SafeMode for specified paths. When set for /_catalogs/masterpage/* with AllowServerSideScript="true", full inline code execution is permitted — completely bypassing SafeMode protections.

Root Cause Analysis

SharePoint’s Upload.aspx page (code-behind: UploadPage in microsoft.office.policy.pages.dll) accepts two query string parameters:

Vulnerable Call Stack

Vulnerable Code (Pre-Patch)

Patch Diff (KB5002874 / KB5002880)

Patched Code

Exploit Chain Detail

Tier 1 — Arbitrary File Upload to Restricted Libraries Unconditional

Tier 2 — RCE via Master Page Gallery Conditional on PageParserPaths

HTTP Request Anatomy

Proof-of-Concept & Evidence

Path Traversal PoC

PoC Execution — Vulnerable Server

PoC Execution — Patched Server

PageParserPaths Configuration (RCE Prerequisite)

Test Results Comparison

Affected Products

Vulnerable Binary Details

Tested Environment

Impact Assessment

Impact Tiers

Detection

Network-Based — Suricata Rules

Host-Based — PowerShell Detection Script

ULS Log Tags (Post-Patch)

HTTP Signature Reference

Mitigation & Recommendations

Immediate — Apply Patches

• SharePoint Server 2019 — Install KB5002874 (June 2026). Patches CurrentFolder property with ParentListId ownership check.
• SharePoint Enterprise Server 2016 — Install KB5002880 (June 2026). Same fix applied to SP2016 codebase.
• SharePoint Server Subscription Edition — Consult MSRC advisory for applicable cumulative update.

Short-Term — Defence in Depth

• Remove or restrict PageParserPaths — If custom branding does not require server-side code in the Master Page Gallery, remove the <PageParserPath> entry from web.config. This eliminates the RCE escalation path entirely, even on unpatched servers.
• IIS Request Filtering — Block RootFolder parameters containing _catalogs in requests to /_layouts/15/Upload.aspx using URL Rewrite rules.
• Audit Master Page Gallery — Review /_catalogs/masterpage for unexpected .aspx files. Any page not part of the original installation or known customizations should be investigated.
• Least-privilege permissions — Review Contribute permission grants across document libraries. Restrict upload permissions to libraries where users genuinely need to add content.

Post-Incident — Forensic Checks

Timeline

References

• Microsoft Security Response Center — CVE-2026-45454 Advisory
• MITRE CVE — CVE-2026-45454
• NVD — CVE-2026-45454
• Microsoft CVRF — June 2026
• KB5002874 — SharePoint Server 2019 (June 2026)
• KB5002880 — SharePoint Enterprise Server 2016 (June 2026)
• Aretiq AI — Original Research Article
• Vulnerable binary: microsoft.office.policy.pages.dll — UploadPage.CurrentFolder,

CurrentFolderServerRelativeUrl

PoC: exploit_upload_traversal.py, exploit_rce_masterpage.py — authorised testing only

Downloads & Resources

Original Research PoCs

Supplementary Materials