Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-05-12T16:59:01 dotnet: .NET: improper handling of files allows an attacker to write to certain locations 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CWE-36

A tampering vulnerability exists when .NET Core improperly handles specially crafted files. An attacker who successfully exploited this vulnerability could write arbitrary files and directories to certain locations on a vulnerable system. However, an attacker would have limited control over the destination of the files and directories. To exploit the vulnerability, an attacker must send a specially crafted file to a vulnerable system. The security update fixes the vulnerability by ensuring .NET Core properly handles files.

A flaw was found in dotnet. Improper handling of specially crafted files can cause a path traversal vulnerability in .NET Core, allowing an attacker who can send a malicious file to a vulnerable system to write to arbitrary files and directories in certain locations.

This vulnerability can be exploited by an attacker who can send specially crafted files to a vulnerable system. However, the attacker has limited control over the destination of the files and directories that can be accessed, limiting the impact of this flaw. Due to these reasons, this issue has been rated with a moderate severity. This vulnerability affects .NET running on Windows systems. Therefore, Red Hat products are not affected by this issue. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat Enterprise Linux 10 Not affected dotnet10.0 Red Hat Enterprise Linux 10 Not affected dotnet8.0 Red Hat Enterprise Linux 10 Not affected dotnet9.0 Red Hat Enterprise Linux 8 Not affected dotnet10.0 Red Hat Enterprise Linux 8 Not affected dotnet8.0 Red Hat Enterprise Linux 8 Not affected dotnet9.0 Red Hat Enterprise Linux 9 Not affected dotnet10.0 Red Hat Enterprise Linux 9 Not affected dotnet8.0 Red Hat Enterprise Linux 9 Not affected dotnet9.0 Red Hat Hardened Images Not affected dotnet10.0 Red Hat Hardened Images Not affected dotnet8.0 Red Hat Hardened Images Not affected dotnet9.0 https://www.cve.org/CVERecord?id=CVE-2026-32175 https://nvd.nist.gov/vuln/detail/CVE-2026-32175 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32175