Relative Path Traversal in Power Automate

Publication date: 2026-09-08

Last updated on: 2026-09-09

Assigner: Microsoft Corporation

Description

Relative path traversal in Power Automate allows an authorized attacker to elevate privileges locally.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-09

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-77897

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	power_automate	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-23	The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a relative path traversal in Power Automate that allows an authorized attacker to elevate their privileges locally. This means an attacker with some access could manipulate file paths to gain higher permissions than intended.

Impact Analysis

If exploited, this vulnerability could allow an attacker to gain elevated privileges on your system, potentially leading to unauthorized access to sensitive data or system functions. It requires the attacker to already have some level of authorized access.

Mitigation Strategies

Apply the latest security updates from Microsoft for Power Automate as soon as possible to address the relative path traversal vulnerability.

Hi! I’m here to help you understand CVE-2026-77897. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70