Remote Code Execution via Relative Path Traversal in Microsoft PowerShell

Relative path traversal in Microsoft PowerShell Core allows an unauthorized attacker to execute code over a network.

• Microsoft PowerShell 7.4: affected from 7.4.0, with lessThan: 7.4.19.0.
• Microsoft PowerShell 7.5: affected from 7.5.0, with lessThan: 7.5.10.0.
• Microsoft PowerShell 7.6: affected from 7.6.0, with lessThan: 7.6.5.

The record does not identify other PowerShell branches or operating-system-specific deployments as affected. The status of versions outside these exact ranges is not inferred here.

The weakness is CWE-23, Relative Path Traversal. This class generally occurs when a relative path supplied or influenced by an attacker is resolved outside the intended directory because traversal elements are not adequately constrained. For this record, the vulnerable PowerShell component, exact attacker-controlled field, network protocol, and endpoint are not identified. The supported attack characteristics are network reachability, low attack complexity, no required privileges, and required user interaction. If the vulnerable path handling is reached, the stated outcome is code execution within the same security scope as the affected component. The record does not establish whether the code runs under a service account, an interactive user account, or another host context.

The vulnerability is network reachable, and the record states that no privileges are required before exploitation. Attack complexity is low, but user interaction is required, so the attacker cannot be assumed to succeed without a user or user-driven process participating. The supplied record marks public exploit as false and does not confirm a known exploited status. The returned CISA ADP enrichment records exploitation as none and automatable as no for its assessment; this does not establish that future exploitation is impossible. The available evidence does not describe exploit steps, payloads, campaigns, victims, or specific indicators.

Successful exploitation could result in remote code execution within the affected PowerShell execution context. Depending on that context's permissions, the attacker could read sensitive information, alter data or system state, and affect availability. The scope is recorded as unchanged, so the stated impact is to resources governed by the same security authority as the vulnerable component. The record does not show that code execution automatically grants administrator or system-level privileges, and no post-exploitation details are provided.

A successful attack could allow code execution in the affected PowerShell security context. Depending on that context's permissions, the attacker could expose confidential data, modify files or configuration, and affect service availability. Because user interaction is required, exploitation depends on persuading or otherwise causing a user or user-driven process to participate. The available evidence does not establish that any organization was breached or that exploitation occurred.

1. Upgrade each affected branch to the corresponding boundary release recorded as outside the affected range: PowerShell 7.4 to 7.4.19.0, PowerShell 7.5 to 7.5.10.0, and PowerShell 7.6 to 7.6.5.
2. After deployment, verify that the installed build no longer falls within the affected range for its branch. Do not treat a fix for one branch as evidence that parallel branches are safe.
3. The record provides no vendor-specific workaround. If immediate updating is not possible, apply the organization's standard measures to reduce unnecessary network exposure, while treating them as precautionary risk reduction rather than a confirmed replacement for the update.

1. Inventory installed PowerShell packages, binaries, containers, and managed hosts, recording the exact branch and build for each installation.
2. Compare each build with the branch-specific affected boundaries in affected_summary, prioritizing installations within a listed range.
3. Identify deployments where PowerShell processes network-delivered input or is invoked by a network-facing service, because the record describes network reachability but does not name a specific endpoint.
4. As a precaution, review process-creation, script-execution, and file-access telemetry for unexpected PowerShell activity after suspicious requests involving path-like input. These are generic review points, not confirmed indicators for this vulnerability.
5. Do not treat the absence of matching logs as proof that an installation is safe; validate the installed build and update state.