Relative Path Traversal in Microsoft Windows PowerShell Enables Network Code Execution

Relative path traversal in Windows PowerShell allows an authorized attacker to execute code over a network.

The record identifies the following products as affected:

• Microsoft PowerShell 7.5: from 7.5.0 through less than 7.5.11.
• Microsoft PowerShell 7.6: from 7.6.0 through less than 7.6.6.
• Windows 10 Version 1607: from 10.0.14393.0 through less than 10.0.14393.9339.
• Windows 10 Version 1809: from 10.0.17763.0 through less than 10.0.17763.9020.
• Windows 10 Version 21H2: from 10.0.19044.0 through less than 10.0.19044.7548.
• Windows 10 Version 22H2: from 10.0.19045.0 through less than 10.0.19045.7548.
• Windows 11 Version 24H2: from 10.0.26100.0 through less than 10.0.26100.8875.
• Windows 11 Version 25H2: from 10.0.26200.0 through less than 10.0.26200.8875.
• Windows 11 version 26H1: from 10.0.28000.0 through less than 10.0.28000.2525.
• Windows Server 2012, including Server Core installation: from 6.2.9200.0 through less than 6.2.9200.26226.
• Windows Server 2012 R2, including Server Core installation: from 6.3.9600.0 through less than 6.3.9600.23291.
• Windows Server 2016, including Server Core installation: from 10.0.14393.0 through less than 10.0.14393.9339.
• Windows Server 2019, including Server Core installation: from 10.0.17763.0 through less than 10.0.17763.9020.
• Windows Server 2022: from 10.0.20348.0 through less than 10.0.20348.5386.
• Windows Server 2025, including Server Core installation: from 10.0.26100.0 through less than 10.0.26100.33158.

The status of versions, branches, or platforms not listed is not established by this record.

Microsoft Windows PowerShell contains a relative path traversal weakness classified as CWE-23. An authorized attacker can provide network-reachable input that causes PowerShell to handle a relative path unsafely and reach code execution. The recorded attack characteristics require low privileges and user interaction; the record does not identify the specific input field, endpoint, service, code path, or execution context. The affected scope is the PowerShell and Windows branches listed in affected_summary.

The flaw is reachable over a network and requires an authorized attacker with low privileges. The record describes low attack complexity and required user interaction, so exploitation is not fully autonomous based on the available evidence. The record lists no public exploit and does not provide confirmed real-world exploitation status. That does not establish that exploitation has not occurred.

The weakness can lead to code execution over a network when the required conditions are met. The record indicates potential impact to the confidentiality, integrity, and availability of resources within the execution context. Because the scope is described as unchanged, the expected impact remains within the security authority of the affected component or system, although the practical consequences depend on account permissions and reachable resources. Required user interaction and low attacker privileges are important limits on the attack path.

If successfully exploited, the weakness could allow code execution in the context of the affected component or account. Possible consequences include disclosure, modification, or disruption of data and services reachable from that context. The practical impact depends on the account's permissions, the resources accessible to PowerShell, and additional controls in the environment. The record does not identify a specific campaign, victim, or breach.

1. Update Microsoft PowerShell 7.5 to 7.5.11 and Microsoft PowerShell 7.6 to 7.6.6 when those releases correspond to the deployed branch.
2. Deploy the Microsoft update for each affected Windows branch and verify that the resulting build reaches the applicable remediation boundary: 10.0.14393.9339 for Windows 10 Version 1607 and Windows Server 2016; 10.0.17763.9020 for Windows 10 Version 1809 and Windows Server 2019; 10.0.19044.7548 for Windows 10 Version 21H2; 10.0.19045.7548 for Windows 10 Version 22H2; 10.0.26100.8875 for Windows 11 Version 24H2 and 10.0.26100.33158 for Windows Server 2025; 10.0.26200.8875 for Windows 11 Version 25H2; 10.0.28000.2525 for Windows 11 version 26H1; 6.2.9200.26226 for Windows Server 2012; 6.3.9600.23291 for Windows Server 2012 R2; and 10.0.20348.5386 for Windows Server 2022.
3. Include Server Core installation deployments in the review when they run the corresponding Windows Server branches.
4. If immediate updating is not possible, apply appropriate precautions such as reducing network reachability to PowerShell functionality, restricting account privileges, and reducing workflows that require user interaction. These are general defensive measures, not a specific vendor-confirmed workaround in the record.
5. Do not treat an unlisted build or branch as confirmed safe; reconcile it with the applicable Microsoft guidance.

• Inventory systems running Windows PowerShell 7.5 or 7.6 and systems using the affected Windows branches.
• Compare installed PowerShell and OS build values with the boundaries in affected_summary; do not infer that an unlisted branch is safe.
• Verify that the applicable Microsoft security update has been deployed and that the resulting build reaches the branch-specific remediation boundary.
• Review network use of PowerShell, low-privilege accounts with access, and workflows that require user interaction. This is precautionary monitoring, not a vendor-confirmed indicator.
• No specific IOC, log event, or forensic pattern is provided. The absence of matching log evidence does not prove that a system is safe.