{"id":"CVE-2026-123973","kind":"vulnerability","aliases":["CVE-2026-123973"],"related":[],"title":"CopyMove for SharePoint: ZIP import lets authenticated users write files outside directory","description":"SharePoint Products CopyMove before 2026-11-06 allows traversal. An authenticated SharePoint user with the necessary permissions to use the ZIP import functionality may exploit a path traversal vulnerability in CopyMove for SharePoint 2019 and CopyMove for SharePoint V6 by supplying a crafted ZIP archive. A path traversal vulnerability in the ZIP import functionality of SharePoint Products ApS CopyMove for SharePoint 2019 and CopyMove for SharePoint V6 allows a user with access to the ZIP import functionality to supply a crafted ZIP archive containing malicious entry paths. During extraction, these paths may cause files to be written outside the intended extraction directory. The issue has been addressed by implementing ZIP archive entry path validation to prevent extraction outside the designated directory.","summary":"CopyMove for SharePoint 2019 and CopyMove for SharePoint V6 have a path traversal flaw in their ZIP import feature. An authenticated user with access to that feature can supply a crafted ZIP archive whose entry paths write files outside the intended extraction directory.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["copymove-for-sharepoint","other","self-hosted","sharepoint"],"not_affected_if":["add-on-not-installed","no-zip-import-access"],"how_to_check":"- Check whether CopyMove for SharePoint 2019 or CopyMove for SharePoint V6 is installed on the SharePoint farm.\n- Check whether the ZIP import functionality is in use and which users have access to it.\n- Compare the installed version with the vendor's advisory; the sources give no fixed version.","fix":"- The vendor says the issue is addressed by adding ZIP archive entry path validation; no fixed version is named in the sources.","status":"open","published_at":"2026-11-06T18:18:05+00:00","first_seen_at":"2026-11-06T18:44:09+00:00","triaged_at":"2026-11-06T18:45:29+00:00","updated_at":"2026-11-06T18:45:29+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-06T18:45:29Z","model":"claude-haiku-5-5","output":{"fix":"- The vendor says the issue is addressed by adding ZIP archive entry path validation; no fixed version is named in the sources.","reach":"network","title":"CopyMove for SharePoint: ZIP import lets authenticated users write files outside directory","impact":"medium","summary":"CopyMove for SharePoint 2019 and CopyMove for SharePoint V6 have a path traversal flaw in their ZIP import feature. An authenticated user with access to that feature can supply a crafted ZIP archive whose entry paths write files outside the intended extraction directory.","audience":"businesses","category":"other","nicknames":[],"who_cares":["sharepoint","copymove-for-sharepoint","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Files written outside the extraction directory on the SharePoint server","analyst_note":"Find the fixed version of CopyMove for SharePoint 2019 and V6 in the vendor advisory; NVD only gives the 2026-11-06 date.","how_to_check":"- Check whether CopyMove for SharePoint 2019 or CopyMove for SharePoint V6 is installed on the SharePoint farm.\n- Check whether the ZIP import functionality is in use and which users have access to it.\n- Compare the installed version with the vendor's advisory; the sources give no fixed version.","plain_action":"","needs_analyst":true,"not_affected_if":["add-on-not-installed","no-zip-import-access"],"who_is_affected":"Organizations running CopyMove for SharePoint 2019 or CopyMove for SharePoint V6 where users can use the ZIP import feature. Exposure depends on the add-on being installed and on which accounts hold ZIP import permission. Farms without the add-on, or where only trusted administrators can use ZIP import, are lower risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.0014,"input_tokens":4395,"output_tokens":1921,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-06':77C '-11':76C '-123973':15A,18A '-2026':14A,17A '2019':31B,104C,132C '2026':75C 'access':51B,142C 'address':177C 'allow':78C,138C 'ap':128C 'archiv':60B,115C,153C,181C 'authent':7A,48B,81C 'caus':163C 'contain':154C 'copymov':1A,20B,28B,33B,73C,101C,106C,129C,134C 'copymove-for-sharepoint':19B 'craft':58B,113C,151C 'cve':13A,16A 'design':190C 'directori':12A,70B,172C,191C 'entri':62B,156C,182C 'exploit':95C 'extract':69B,159C,171C,187C 'featur':46B,54B 'file':10A,65B,164C 'flaw':41B 'function':93C,124C,147C 'host':26B 'implement':179C 'import':5A,45B,92C,123C,146C 'intend':68B,170C 'issu':174C 'let':6A 'malici':155C 'may':94C,162C 'necessari':86C 'outsid':11A,66B,168C,188C 'path':39B,63B,97C,117C,157C,161C,183C 'permiss':87C 'prevent':186C 'product':72C,127C 'self':25B 'self-host':24B 'sharepoint':3A,22B,27B,30B,35B,71C,82C,103C,108C,126C,131C,136C 'suppli':56B,111C,149C 'travers':40B,79C,98C,118C 'use':89C 'user':8A,49B,83C,140C 'v6':36B,109C,137C 'valid':184C 'vulner':99C,119C 'whose':61B 'write':9A,64B 'written':167C 'zip':4A,44B,59B,91C,114C,122C,145C,152C,180C","nicknames":[],"mitigations":[],"who_affected":"Organizations running CopyMove for SharePoint 2019 or CopyMove for SharePoint V6 where users can use the ZIP import feature. Exposure depends on the add-on being installed and on which accounts hold ZIP import permission. Farms without the add-on, or where only trusted administrators can use ZIP import, are lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["copymoveforsharepoint","medium","other","selfhosted","sharepoint"],"campaign_type":null,"search_a":"'-123973':15A,18A '-2026':14A,17A 'authent':7A 'copymov':1A 'cve':13A,16A 'directori':12A 'file':10A 'import':5A 'let':6A 'outsid':11A 'sharepoint':3A 'user':8A 'write':9A 'zip':4A","search_b":"'2019':31B 'access':51B 'archiv':60B 'authent':48B 'copymov':20B,28B,33B 'copymove-for-sharepoint':19B 'craft':58B 'directori':70B 'entri':62B 'extract':69B 'featur':46B,54B 'file':65B 'flaw':41B 'host':26B 'import':45B 'intend':68B 'outsid':66B 'path':39B,63B 'self':25B 'self-host':24B 'sharepoint':22B,27B,30B,35B 'suppli':56B 'travers':40B 'user':49B 'v6':36B 'whose':61B 'write':64B 'zip':44B,59B","search_c":"'-06':77C '-11':76C '2019':104C,132C '2026':75C 'access':142C 'address':177C 'allow':78C,138C 'ap':128C 'archiv':115C,153C,181C 'authent':81C 'caus':163C 'contain':154C 'copymov':73C,101C,106C,129C,134C 'craft':113C,151C 'design':190C 'directori':172C,191C 'entri':156C,182C 'exploit':95C 'extract':159C,171C,187C 'file':164C 'function':93C,124C,147C 'implement':179C 'import':92C,123C,146C 'intend':170C 'issu':174C 'malici':155C 'may':94C,162C 'necessari':86C 'outsid':168C,188C 'path':97C,117C,157C,161C,183C 'permiss':87C 'prevent':186C 'product':72C,127C 'sharepoint':71C,82C,103C,108C,126C,131C,136C 'suppli':111C,149C 'travers':79C,98C,118C 'use':89C 'user':83C,140C 'v6':109C,137C 'valid':184C 'vulner':99C,119C 'written':167C 'zip':91C,114C,122C,145C,152C,180C","first_public_at":"2026-11-06T18:18:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123973","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123973","severity":null,"published_at":"2026-11-06T18:18:05+00:00","modified_at":"2026-11-06T18:18:05+00:00","first_seen_at":"2026-11-06T18:44:09+00:00","fetched_at":"2026-11-06T18:44:09+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}