Microsoft .NET SDK: Local privilege escalation via path traversal
Summary
A path traversal flaw in the .NET SDK's workload support lets an authorized local user escalate privileges. An attacker-controlled workload manifest ID can escape the intended folder under %ProgramData%\dotnet and get attacker-controlled MSBuild targets imported during elevated operations. Exploitation requires a local foothold, a manipulated manifest and an elevated 'dotnet workload' run, and the flaw is not network-reachable.
Affected
- .NET SDK 11.0 previews: 11.0.100-preview.1 to 11.0.100-rc.1
- .NET SDK 10.0: 10.0.100 to 10.0.112
- .NET SDK 10.0 (4xx band): 10.0.400 to 10.0.401
- Visual Studio 2022 17.14 and 2026 18.10 (CVE record, versions below 17.14.42 and 18.10.4)
- .NET runtime packages: sources conflict, verify on the MSRC page
Fixed in
- .NET SDK 11.0: 11.0.100-rc.2
- .NET SDK 10.0: 10.0.113
- .NET SDK 10.0 (4xx band): 10.0.402
- Visual Studio 2022 17.14: 17.14.42
- Visual Studio 2026 18.10: 18.10.4
Workaround
- No vendor workaround found.
- Restrict write access to %ProgramData%\dotnet and similar paths.
- Run 'dotnet workload' commands elevated only when needed.
Exploitation
- No exploitation in the wild found.
- Not listed in CISA KEV; CISA SSVC lists exploitation as none and automatable as no.
- No public proof of concept found; this does not prove that none exists.
- EPSS below 1%.
Our recommendation
- Update the .NET SDK and Visual Studio to the fixed versions, including build agent and CI runner images.
- Check where .NET 6 SDKs are installed and remove unused ones; .NET 6 status is unverified.
- Limit who can write to %ProgramData%\dotnet on developer and build hosts.
- Patch in the next regular maintenance window, sooner for multi-user build hosts.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-70161 msrc.microsoft.com
- dotnet/announcements issue 453 github.com
- HeroDevs vulnerability directory: CVE-2026-70161 www.herodevs.com
- Rapid7 Patch Tuesday October 2026 www.rapid7.com
- Strix: CVE-2026-70161 www.strix.ai
- Vulners CVE record CVE-2026-70161 (CNA data) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 3 Nov 2026, 02:10.
Original description (NVD)
Improper limitation of a pathname to a restricted directory ('path traversal') in .NET allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.