{"id":"CVE-2026-114148","kind":"vulnerability","aliases":["CVE-2026-114148"],"related":[],"title":"ASP.NET Core: default file permissions let a local user gain higher privileges","description":"Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.","summary":"Linux ASP.NET Core runtime and targeting-pack tarballs (and source-built .NET tarballs) carry unsafe numeric file ownership. If they are extracted so that ownership is preserved (for example as root, or in a container image import), a local user can modify runtime files that a more privileged app then uses, and gain higher privileges. It is a local attack only.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ASP.NET Core 8 Linux tarballs","fixed":["8.0.33"],"affected":">= 8.0.0, < 8.0.33","ecosystem":"vendor"},{"name":"ASP.NET Core 9 Linux tarballs","fixed":["9.0.22"],"affected":">= 9.0.0, < 9.0.22","ecosystem":"vendor"}],"ecosystems":[],"tags":["aspnet-core","container","dotnet","linux","runtime","tarball","windows"],"not_affected_if":["extracted-with-no-same-owner","managed-hosting","no-local-untrusted-users"],"how_to_check":"A .NET version number alone does not tell you. Check whether the runtime or targeting pack was installed from an aspnetcore-runtime-*, aspnetcore-runtime-composite-* or aspnetcore-targeting-pack-* Linux tar.gz older than 8.0.33 / 9.0.22 (or from a source-built .NET archive in the affected ranges). Then check that extraction preserved numeric ownership: inspect the install directory (e.g. ls -lnR on it) for files owned by a non-admin UID or writable via group, others or ACLs. Restoring NuGet runtime packages does not introduce the defect.","fix":"Replace the installation with a clean one in a NEW empty directory from the patched tarball: ASP.NET Core 8.0.33 or 9.0.22 (source-built: 8.0.133, 9.0.123, 10.0.114-servicing.26522.126, 10.0.403-servicing.26523.112, 11.0.100-rc.3.26522.148). Extract with tar --no-same-owner --no-same-permissions in an admin-controlled directory. Updating over the old tree or changing a NuGet reference does not fix it. Rebuild custom container images the same way.","status":"open","published_at":"2026-10-29T16:17:58+00:00","first_seen_at":"2026-10-29T16:25:56+00:00","triaged_at":"2026-10-29T16:29:38+00:00","updated_at":"2026-10-29T16:39:26+00:00","category":"runtime","confidence":0.85,"triage":{"at":"2026-10-29T16:29:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"ASP.NET Core: default file permissions let a local user gain higher privileges","impact":"high","summary":"ASP.NET Core ships with incorrect default permissions on some files or resources. A local user who already has an account on the machine can use this to raise their privileges.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["aspnet-core","dotnet","windows","linux"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains higher privileges on the machine","analyst_note":"Find the NVD entry or Microsoft advisory for CVE-2026-114148 to get affected versions, fixed versions and the exact permissions involved.","how_to_check":"- Confirm the installed ASP.NET Core runtime version with `dotnet --list-runtimes`\n- Review the affected file permissions on the host (unknown which paths the sources name)","plain_action":"","needs_analyst":true,"not_affected_if":["no-local-untrusted-users","managed-hosting"],"who_is_affected":"Only machines running ASP.NET Core where an untrusted or low-privilege local user has an account. The sources do not name the affected versions or the exact default permissions, so the scope is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000647,"input_tokens":4060,"output_tokens":482,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the NVD entry or Microsoft advisory for CVE-2026-114148 to get affected versions, fixed versions and the exact permissions involved.","search":"'-114148':15A,18A '-2026':14A,17A '8':21A '9':26A 'allow':106C 'app':88B 'asp.net':1A,19A,24A,39B,104C 'aspnet':30B 'aspnet-cor':29B 'attack':99B,109C 'author':108C 'built':50B 'carri':53B 'contain':32B,74B 'core':2A,20A,25A,31B,40B,105C 'cve':13A,16A 'default':3A,101C 'dotnet':33B 'elev':111C 'exampl':68B 'extract':61B 'file':4A,56B,83B 'gain':10A,92B 'higher':11A,93B 'imag':75B 'import':76B 'incorrect':100C 'let':6A 'linux':22A,27A,34B,38B 'local':8A,78B,98B,113C 'modifi':81B 'net':51B 'numer':55B 'ownership':57B,64B 'pack':45B 'permiss':5A,102C 'preserv':66B 'privileg':12A,87B,94B,112C 'root':70B 'runtim':35B,41B,82B 'sourc':49B 'source-built':48B 'tarbal':36B,46B,52B 'tarballs':23A,28A 'target':44B 'targeting-pack':43B 'unsaf':54B 'use':90B 'user':9A,79B 'window':37B","nicknames":[],"mitigations":[],"who_affected":"Linux hosts and container images where the ASP.NET Core runtime or targeting pack was installed from a Microsoft tar.gz (or a source-built .NET tarball) with ownership preserved, and where untrusted local accounts exist. Skip it if you are on managed hosting, if no untrusted local users can reach the machine, or if the files were extracted with --no-same-owner into an admin-owned directory.","tier":"B","verified":{"fix":{"at":"2026-10-29T16:39:26Z","by":"analyst","doc":"https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/","run_id":1082},"products":{"at":"2026-10-29T16:39:26Z","by":"analyst","doc":"https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/","run_id":1082},"how_to_check":{"at":"2026-10-29T16:39:26Z","by":"analyst","doc":"https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/","run_id":1082},"who_affected":{"at":"2026-10-29T16:39:26Z","by":"analyst","doc":"https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/","run_id":1082}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:17:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114148","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114148","severity":null,"published_at":"2026-10-29T16:17:58+00:00","modified_at":"2026-10-29T16:17:58+00:00","first_seen_at":"2026-10-29T16:25:56+00:00","fetched_at":"2026-10-29T16:25:56+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114148:1082","url":null,"severity":null,"published_at":"2026-10-29T16:39:26+00:00","modified_at":"2026-10-29T16:39:26+00:00","first_seen_at":"2026-10-29T16:39:26+00:00","fetched_at":"2026-10-29T16:39:26+00:00","note":"Read Microsoft advisory GHSA-r6pf-x897-gm86 (Oct 25 2026 OOB). Bug is Linux tarball file ownership (CWE-276), not ASP.NET Core code; fix is clean reinstall from patched tarball. No exploitation or PoC seen; no social search done (B tier, local EoP)."}],"documents":[{"id":17838,"url":"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-r6pf-x897-gm86","title":"Microsoft Security Advisory CVE-2026-114148 (GHSA-r6pf-x897-gm86)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":17839,"url":"https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/","title":".NET October 2026 Out-of-Band Security Updates","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}