SharePoint Server: Path traversal vulnerability in Microsoft SharePoint allowing network spoofing (CVE-2025-53771) #shorts

Summary

In today’s episode, we break down CVE-2025-53771, a critical path traversal vulnerability in Microsoft SharePoint actively exploited in the wild. Microsoft released an urgent patch on July 20, 2025, alongside CVE-2025-53770, after Talos Intelligence flagged ongoing attacks. Administrators running vulnerable SharePoint versions need to update immediately to prevent spoofing and data exposure.

Product details

CVE-2025-53771 impacts Microsoft SharePoint Enterprise Server 2016 prior to build 16.0.5513.1001, SharePoint Server 2019 before build 16.0.10417.20037, and SharePoint Server Subscription Edition before build 16.0.18526.20508. All affected versions allow authenticated users to manipulate file paths on the server. Microsoft’s security advisory covers both on-premises and hybrid deployments.

Vulnerability type summary

This issue involves improper limitation of a pathname to a restricted directory (CWE-22), coupled with inadequate input validation (CWE-20) and neutralization (CWE-707). Attackers exploit path traversal to traverse directories and spoof content, potentially tricking users or services into processing malicious files.

Details of the vulnerability

An authorized attacker with minimal privileges can craft specially formed requests to traverse outside the designated SharePoint directories. By exploiting insufficient input validation, they can upload or reference files in locations used for rendering pages or feeds. Talos Intelligence reports active exploitation campaigns targeting SharePoint servers, where attackers embed malicious payloads or phishing content to compromise credentials and propagate further.

Conclusion

If you manage any affected SharePoint environment, apply Microsoft’s July 2025 security updates immediately. Monitor your logs for unusual file‐access patterns and implement additional path validation controls where possible. Stay tuned for follow-up guidance on detecting and mitigating similar server-side vulnerabilities.

This chain involves the following actors

• Authorized attacker: Insider threat with valid credentials
• SharePoint administrator: Responsible for system maintenance and patch deployment

This following systems are involved

• Microsoft SharePoint Enterprise Server 2016 (<16.0.5513.1001) (On-premises collaboration and content management): Primary target for exploitation
• Microsoft SharePoint Server 2019 (<16.0.10417.20037) (Enterprise document sharing platform): Primary target for exploitation
• Microsoft SharePoint Server Subscription Edition (<16.0.18526.20508) (Subscription-based collaboration service): Primary target for exploitation

Attack entry point

• File retrieval API endpoint: Handles requests for downloading files based on a path parameter; lacks proper normalization to prevent directory traversal

Remediation actions

Exploitation actions

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53771
• [2025-07-22] Talos Intelligence reports on ongoing exploitation of CVE-2025-53770 and CVE-2025-53771, path traversal vulnerabilities affecting SharePoint servers.
• [2025-07-21] Urgent update to Microsoft SharePoint due to active exploitation of vulnerabilities CVE-2025-53770 and CVE-2025-53771
• [2025-07-21] Learn about critical vulnerabilities in Microsoft SharePoint Server and how to detect and mitigate them.
• [2025-07-21] Microsoft releases patches for exploited SharePoint zero-days CVE-2025-53770 and CVE-2025-53771.