ASP.NET Core: Privilege escalation through incorrect default permissions

Summary

Incorrect default file permissions in ASP.NET Core allow a local, authorized user with low privileges to elevate their privileges. Microsoft's advisory limits the issue to Linux installations of the .NET runtime and targeting-pack tarballs and to source-built .NET tarballs, but the official CVE record and some third-party sources list Windows and macOS as well. The impact is high confidentiality, integrity and availability on the affected host. No confirmed exploitation in the wild is known.

Affected

• Vendor advisory (GHSA-r6pf-x897-gm86): ASP.NET Core 8 and 9 runtime and targeting-pack Linux tarballs, 8.0.0 to before 8.0.33 and 9.0.0 to before 9.0.22. Source-built .NET 10.0.1xx Linux distributions are also in scope.
• Official CVE record (Microsoft as CNA): .NET 8.0 before 8.0.427, .NET 9.0 before 9.0.320, .NET 10.0 before 10.0.403 and .NET 11.0 preview builds before 11.0.100-rc.3, listed for Linux, macOS and Windows. This conflicts with the vendor advisory and needs confirmation on the MSRC page.
• Source-built .NET tarballs (Linux): 8.0.100 to before 10.0.403-servicing.26523.112.

Fixed in

• ASP.NET Core 8 runtime and targeting-pack Linux tarballs: 8.0.33 (vendor advisory); 8.0.427 per the CNA record.
• ASP.NET Core 9 runtime and targeting-pack Linux tarballs: 9.0.22 (vendor advisory); 9.0.320 per the CNA record.
• .NET 10: 10.0.403 per the CNA record; the fixed source-built Linux build is not confirmed.
• Ubuntu 24.04 and 22.04: dotnet8 8.0.133-8.0.33-0ubuntu1~24.04.1 and 8.0.133-8.0.33-0ubuntu1~22.04.1.
• AlmaLinux 9: aspnetcore-runtime-9.0 9.0.22-1.el9_8 (third-party data, verify against AlmaLinux errata).

Workaround

Unknown. No vendor workaround was found. Installing the fixed runtime and restarting the application is the documented remedy.

Exploitation

• Microsoft's CISA SSVC assessment: exploitation none, not automatable, technical impact total.
• No confirmed exploitation in the wild; the CISA KEV catalogue was not checked directly.
• Public proof-of-concept code: unclear and conflicting between sources; not verified.
• EPSS 0.36 % (percentile 29), indicating low predicted exploitation.

Our recommendation

• Inventory hosts running .NET or ASP.NET Core, especially installations from Linux tarballs rather than distribution or Microsoft packages.
• Update to the fixed versions listed above, or to package-manager installs, and restart affected applications.
• Check file ownership and permissions of tarball-based .NET installations.
• Limit local shell access on affected hosts, especially shared Linux systems, until patched.
• Confirm the affected product table on the MSRC page, since sources conflict.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  Ghost-Bx1/DotNet-Tarball-CVE-2026-114148

Research sources

• Microsoft Security Response Center: CVE-2026-114148 msrc.microsoft.com
• GitHub Advisory GHSA-r6pf-x897-gm86 (dotnet/aspnetcore) github.com
• Microsoft .NET October 2026 out-of-band security updates devblogs.microsoft.com
• Microsoft .NET 10.0 update October 25, 2026 support.microsoft.com
• Ubuntu Security: CVE-2026-114148 ubuntu.com
• OffSeq Radar: .NET 9.0 security update (CVE-2026-114148) radar.offseq.com
• Vulners: CVE-2026-114148 vulners.com
• Feedly: CVE-2026-114148 feedly.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:44.