CVE-2026-65810
Relative path traversal in .NET Framework allows an unauthorized attacker to elevate privileges locally.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.8
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
- EPSS probability
- 0.27%
- CWE
- CWE-23
- Published
- 2026-08-11
- Last modified
- 2026-09-16
Affected products
- Microsoft Microsoft .NET Framework 3.5
- Microsoft Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2
- Microsoft Microsoft .NET Framework 3.5 AND 4.7.2
- Microsoft Microsoft .NET Framework 3.5 AND 4.8
- Microsoft Microsoft .NET Framework 3.5 AND 4.8.1
- Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2
- Microsoft Microsoft .NET Framework 4.8
- Microsoft Microsoft .NET Framework 4.8.1
Weakness type
Related vulnerabilities
- CVE-2025-64446 — A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb
- CVE-2025-55752 — Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled
- CVE-2025-34510 — Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip
- CVE-2025-52207 — PBXCoreREST/Controllers/Files/PostController.php in MikoPBX through 2024.1.114 allows uploading a PHP script to an arbit
- CVE-2026-33494 — Ory Oathkeeper has a path traversal authorization bypass
- CVE-2025-62878 — Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern
- CVE-2025-3365 — Relative Path Traversal in OnlineSuite
- CVE-2025-47445 — WordPress Eventin plugin <= 4.0.26 - Arbitrary File Download Vulnerability