CVE-2026-102280

Received Received - Intake

Sandbox Escape via File Attribute Manipulation in Sandboxie-Plus

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: GitHub, Inc.

Description

Sandboxie-Plus is an open source sandbox-based isolation software for Windows. Prior to 1.18.6, a process inside a sandbox could send MSGID_FILE_SET_ATTRIBUTES or MSGID_FILE_SET_SHORT_NAME to SbieSvc and cause the SYSTEM service to open and modify an existing file outside the sandbox. The direct primitive changes file attributes, timestamps, writeability, or 8.3 short names; a short-name redirection can additionally contribute to SYSTEM code execution when a privileged process resolves an attacker-controlled short-name path in a location SbieSvc can open. This vulnerability is fixed in 1.18.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-102280

Affected Vendors & Products

Vendor	Product	Version / Range
sandboxie-plus	Sandboxie	< 1.18.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-390	The product detects a specific error, but takes no actions to handle the error.
CWE-668	The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
CWE-636	When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

Sandboxie-Plus before 1.18.6 allows a sandboxed process to send specific messages to the SYSTEM service (SbieSvc) to modify files outside the sandbox. This includes changing file attributes, timestamps, or short names. A short-name redirection could lead to SYSTEM-level code execution if a privileged process uses the modified path.

Impact Analysis

An attacker in a sandbox could alter critical system files, bypassing intended isolation. This may lead to privilege escalation, data corruption, or execution of malicious code with SYSTEM privileges, compromising the entire system.

Compliance Impact

This vulnerability could violate compliance by allowing unauthorized file modifications or privilege escalation, potentially leading to data breaches or unauthorized access. Organizations using Sandboxie-Plus must update to 1.18.6 to maintain compliance.

Mitigation Strategies

Update Sandboxie-Plus to version 1.18.6 or later to address the vulnerability. Avoid running untrusted processes in sandboxed environments until the update is applied.

Hi! I’m here to help you understand CVE-2026-102280. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...