Description
Relative path traversal in Microsoft PowerShell Core allows an unauthorized attacker to execute code over a network.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | PowerShell 7.4 | 7.4.0 – < 7.4.19.0 | 7.4.19.0 |
| Microsoft | PowerShell 7.5 | 7.5.0 – < 7.5.10.0 | 7.5.10.0 |
| Microsoft | PowerShell 7.6 | 7.6.0 – < 7.6.5 | 7.6.5 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | powershell | 7.6.9-r0 | — |
Advisories 3
- WID-SEC-2026-2761 Microsoft Developer Tools: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- MSRC-CVE-2026-70337 Microsoft PowerShell Remote Code Execution Vulnerability Microsoft Security Response Center · Oct 20, 2026
- NCSC-2026-0285 Kwetsbaarheden verholpen in Microsoft Developer Tools NCSC-NL (Netherlands) · Aug 11, 2026
References
- Microsoft PowerShell Remote Code Execution Vulnerability vendor-advisory patch