Executive Summary
A critical path traversal vulnerability (CVE-2026-45454) has been identified in Microsoft SharePoint Server's file upload functionality (`Upload.aspx`). This vulnerability stems from a failure to validate that the destination folder, specified via the `RootFolder` parameter, belongs to the document library authorized by the `List` parameter. An authenticated attacker with basic upload permissions can bypass intended restrictions to write files to sensitive directories.
The most severe impact occurs when attackers target the Master Page Gallery (`/_catalogs/masterpage`). In many production environments, this directory is configured to allow server-side scripts. By uploading a crafted ASPX webshell to this location, attackers can achieve full remote code execution (RCE) under the context of the SharePoint application pool identity (`w3wp.exe`). Microsoft released patches for this vulnerability in June 2026 across SharePoint 2016, 2019, and Subscription Edition.
While Microsoft initially rated the vulnerability as 'Medium' severity with a focus on confidentiality, security researchers have demonstrated high-integrity impact through unauthorized file writes and subsequent system compromise. Organizations utilizing custom branding or master pages are at elevated risk due to common configurations that facilitate the RCE chain.