CVE-2026-70337
Summary
by MITRE • 08/11/2026
Relative path traversal in Microsoft PowerShell Core allows an unauthorized attacker to execute code over a network.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability represents a critical security flaw in Microsoft PowerShell Core that enables remote code execution through relative path traversal techniques. The issue stems from improper validation of file paths when processing commands, allowing attackers to manipulate the execution flow by exploiting directory traversal patterns. When PowerShell processes commands that reference files or directories, it fails to adequately sanitize input paths, creating opportunities for attackers to navigate outside intended directories and execute arbitrary code on target systems. This weakness directly maps to CWE-22, which describes improper limitation of a pathname to a restricted directory, commonly known as path traversal or directory traversal attacks. The vulnerability operates at the application layer and can be exploited remotely without requiring authentication, making it particularly dangerous in networked environments where PowerShell is deployed.
The technical implementation of this flaw allows attackers to craft malicious PowerShell commands that leverage relative paths to access system resources they should not normally have permission to reach. By carefully constructing path references using sequences like "..", PowerShell Core fails to properly resolve these paths against the intended execution context, enabling attackers to load and execute arbitrary scripts or binaries from unexpected locations. This vulnerability affects various PowerShell operations including script execution, module loading, and file access functions where relative paths are processed. The attack vector typically involves sending specially crafted PowerShell commands over network protocols such as WinRM or PowerShell remoting services, where the target system processes these commands without adequate path validation.
The operational impact of this vulnerability extends beyond simple code execution to potentially compromise entire system infrastructures. Once an attacker successfully exploits this weakness, they can execute malicious payloads with the privileges of the PowerShell process, which often runs with elevated permissions in enterprise environments. This allows for lateral movement within networks, privilege escalation, and data exfiltration activities. The vulnerability is particularly concerning because PowerShell is widely used across enterprise environments for automation, system administration, and security tooling, making it an attractive target for attackers seeking persistent access to critical infrastructure. According to ATT&CK framework, this vulnerability aligns with T1059.001 (PowerShell) and T1566 (Phishing), as it can be exploited through malicious PowerShell scripts delivered via various attack vectors including spear-phishing campaigns or compromised systems.
Effective mitigation strategies must address both the immediate vulnerability and underlying architectural weaknesses in PowerShell's path handling mechanisms. Organizations should implement strict input validation for all file paths processed by PowerShell, particularly those derived from user inputs or network communications. Regular updates and patches from Microsoft should be applied immediately upon release to address known vulnerabilities. Network segmentation and access controls should limit PowerShell remoting capabilities to trusted networks only, while monitoring systems should detect unusual PowerShell activity patterns that might indicate exploitation attempts. Additionally, implementing principle of least privilege for PowerShell execution contexts and disabling unnecessary PowerShell features can significantly reduce the attack surface. The use of PowerShell Script Block Logging and Advanced Threat Protection features provided by Microsoft can help detect and prevent exploitation attempts, while regular security assessments should verify that path validation mechanisms are properly implemented across all PowerShell environments.