CVE-2026-45491 .NET Tampering Vulnerability
An attacker can tamper with files locally by exploiting improper link resolution in the .NET runtime.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45491?
CVE-2026-45491 is a medium-severity path traversal vulnerability in Microsoft .Net, published on 9 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Improper link resolution before file access ('link following') in .NET allows an unauthorized attacker to perform tampering locally.
Weakness: CWE-59
Which versions are affected by CVE-2026-45491?
20 open source packages ship an affected version, including Microsoft.NETCore.App.Runtime.linux-x64, dotnet and dotnet-sdk. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
Microsoft.NETCore.App.Runtime.linux-x64 NuGet | From 10.0.0 | 10.0.9 |
Microsoft.NETCore.App.Runtime.linux-x64 NuGet | From 10.0.0 | 10.0.9 |
Microsoft.NETCore.App.Runtime.linux-x64 NuGet | From 8.0.0 | 8.0.28 |
Microsoft.NETCore.App.Runtime.linux-x64 NuGet | From 8.0.0 | 8.0.28 |
Microsoft.NETCore.App.Runtime.linux-x64 NuGet | From 9.0.0 | 9.0.17 |
Microsoft.NETCore.App.Runtime.linux-x64 NuGet | From 9.0.0 | 9.0.17 |
14 more packages
dotnet Bitnami | From 8.0.0 | 8.0.28, 9.0.17, 10.0.9 |
dotnet-sdk Bitnami | From 8.0.0 | 8.0.28, 9.0.17, 10.0.9 |
Microsoft.NETCore.App.Runtime.osx-arm64 NuGet | From 10.0.0 | 10.0.9 |
Microsoft.NETCore.App.Runtime.osx-arm64 NuGet | From 10.0.0 | 10.0.9 |
Microsoft.NETCore.App.Runtime.osx-arm64 NuGet | From 8.0.0 | 8.0.28 |
Microsoft.NETCore.App.Runtime.osx-arm64 NuGet | From 8.0.0 | 8.0.28 |
Microsoft.NETCore.App.Runtime.osx-arm64 NuGet | From 9.0.0 | 9.0.17 |
Microsoft.NETCore.App.Runtime.osx-arm64 NuGet | From 9.0.0 | 9.0.17 |
Microsoft.NETCore.App.Runtime.win-x64 NuGet | From 10.0.0 | 10.0.9 |
Microsoft.NETCore.App.Runtime.win-x64 NuGet | From 10.0.0 | 10.0.9 |
Microsoft.NETCore.App.Runtime.win-x64 NuGet | From 8.0.0 | 8.0.28 |
Microsoft.NETCore.App.Runtime.win-x64 NuGet | From 8.0.0 | 8.0.28 |
Microsoft.NETCore.App.Runtime.win-x64 NuGet | From 9.0.0 | 9.0.17 |
Microsoft.NETCore.App.Runtime.win-x64 NuGet | From 9.0.0 | 9.0.17 |
Products include Microsoft .Net.
How do I fix CVE-2026-45491?
Upgrade Microsoft.NETCore.App.Runtime.linux-x64 to a fixed version for your release line: 10.0.9, 8.0.28 or 9.0.17.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-45491 being exploited?
There is no known exploitation of CVE-2026-45491 in the wild and no public exploit code.
Other vulnerabilities in Microsoft .Net
- CVE-2024-43498 .NET and Visual Studio Remote Code Execution Vulnerability
- CVE-2024-0057 NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability
- CVE-2026-96957 .NET Security Feature Bypass Vulnerability
- CVE-2026-69439 .NET and Visual Studio Elevation of Privilege Vulnerability
- CVE-2026-71328 .NET and Visual Studio Remote Code Execution Vulnerability
Sources
Also known as BIT-dotnet-2026-45491, BIT-dotnet-sdk-2026-45491, GHSA-7q4v-2mr6-5gpx, MINI-p5mf-php4-hrgx, MINI-r6m4-rv2v-9xm8, UBUNTU-CVE-2026-45491.