CVE-2026-78461

Analyzed Analyzed - Analysis Complete

Path Traversal Vulnerability in Visual Studio Code

Publication date: 2026-09-08

Last updated on: 2026-09-11

Assigner: Microsoft Corporation

Description

Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-11

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-78461

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	visual_studio_code	to 1.136.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This is a path traversal vulnerability in Visual Studio Code where an attacker can bypass a security feature by manipulating file paths over a network. It allows unauthorized access to restricted directories.

Impact Analysis

An attacker could access sensitive files or directories on your system through Visual Studio Code, potentially leading to data theft or unauthorized modifications. The attack requires network access but no authentication.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations if sensitive data is exposed due to this flaw.

Mitigation Strategies

Update Visual Studio Code to the latest version to ensure the security feature bypass is patched.

Hi! I’m here to help you understand CVE-2026-78461. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70