CVE-2026-16444 Improper Validation of File Paths in TeamViewer Desktop Clients
An authenticated remote session participant can write files to unintended locations via path traversal, potentially achieving arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-16444?
CVE-2026-16444 is a high-severity path traversal vulnerability in TeamViewer Full Client, Host, QuickSupport & Portable, published on 26 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Improper neutralization of path traversal sequences in TeamViewer Desktop Clients prior Version 15.81.5 allows an authenticated remote session participant to write files to unintended locations on the local file system via file transfer or virtual file clipboard mechanisms. An attacker can leverage this behavior to achieve arbitrary file write and potentially execute code with the privileges of the affected user.
Weakness: CWE-73
Which versions are affected by CVE-2026-16444?
How do I fix CVE-2026-16444?
No fix has been published for CVE-2026-16444 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-16444 being exploited?
There is no known exploitation of CVE-2026-16444 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-3mf4-g44r-xcvg.