Security Advisory
ZIP Slip path traversal in CopyMove ZIP import
Published: November 6, 2026
- CVE ID
- Pending assignment (MITRE CNA-LR)
- Weakness
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") – ZIP Slip
- Vendor
- SharePoint Products ApS
- Affected component
- ZIP import functionality
- Platform
- Windows
- Status
- Vendor-confirmed. Remediation developed and released.
Summary
A path traversal vulnerability (ZIP Slip) in the ZIP import functionality of SharePoint Products ApS CopyMove for SharePoint 2019 and CopyMove for SharePoint V6 allows a user with access to the ZIP import functionality to supply a specially crafted ZIP archive containing malicious entry paths.
During extraction, these paths may cause files to be written outside the intended extraction directory.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| CopyMove for SharePoint V6 | 6.0.0.0 up to, but not including, 6.3.1.2094 | 6.3.1.2094 |
| CopyMove for SharePoint 2019 | 5.0.0.0 up to, but not including, 5.2.1.2095 | 5.2.1.2095 |
Solution
The issue has been addressed by implementing ZIP archive entry path validation to prevent extraction outside the designated directory. Customers should update to the fixed version for their product listed above. Updated installers are available from the download page.
Workarounds
Until the update is applied, restrict access to the ZIP import functionality to trusted users and do not import ZIP archives from untrusted sources.
Credits
This vulnerability was discovered by researchers at the NATO Communications and Information Agency (NCIA) during a security assessment conducted by the NATO Cyber Security Centre. We thank them for their responsible disclosure.
Contact
Questions about this advisory can be sent to support@sharepointproducts.com.