CVE-2024-49360 Path traversal in Sandboxie
An authenticated user can read other users' sandboxed files via path traversal, bypassing intended isolation boundaries.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-49360?
CVE-2024-49360 is a critical path traversal vulnerability in sandboxie-plus Sandboxie, published on 29 Nov 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. An authenticated user (**UserA**) with no privileges is authorized to read all files created in sandbox belonging to other users in the sandbox folders `C:\Sandbox\UserB\xxx`. An authenticated attacker who can use `explorer.exe` or `cmd.exe` outside any sandbox can read other users' files in `C:\Sandbox\xxx`. By default in Windows 7+, the `C:\Users\UserA` folder is not readable by **UserB**. All files edited or created during the sandbox processing are affected by the vulnerability. All files in C:\Users are safe. If `UserB` runs a cmd in a sandbox, he will be able to access `C:\Sandox\UserA`. In addition, if **UserB** create a folder `C:\Sandbox\UserA` with malicious ACLs, when **UserA** will user the sandbox, Sandboxie doesn't reset ACLs ! This issue has not yet been fixed. Users are advised to limit access to their systems using Sandboxie.
Weakness: CWE-22
Which versions are affected by CVE-2024-49360?
It affects 1 product.
Products include Sandboxie-Plus Sandboxie.
How do I fix CVE-2024-49360?
No fix has been published for CVE-2024-49360 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-49360 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-49360 exists.
Other vulnerabilities in sandboxie-plus Sandboxie
- CVE-2018-18748 Security feature bypass in n/a
- CVE-2025-64721 Sandboxie's Integer Overflow in SbieIniServer::RC4Crypt allows sandbox escape and SYSTEM compromise
- CVE-2026-34458 Sandboxie-Plus privilege escalation via INI CRLF injection bypassing EditAdminOnly
- CVE-2026-34459 Sandboxie-Plus sandbox escape via uninitialized memory leak and stack overflow in GetRawInputDeviceInfoSlave
- CVE-2026-34464 Sandboxie-Plus NamedPipeServer OpenHandler stack overflow via unterminated server field
Sources
Also known as GHSA-4chj-3c28-gvmp.