CVE-2026-70161

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

An elevation of privilege vulnerability (CVE-2026-70161) has been identified in the .NET SDK's workload support on Windows. Microsoft describes an attacker-controlled workload manifest ID that can traverse paths under %ProgramData%\dotnet and import attacker-controlled MSBuild targets during elevated workload operations. Microsoft's advisory lists only the .NET SDK 10.0 feature bands and the 11.0 previews as affected; .NET 6 is past end of life and is not assessed there, and HeroDevs confirmed that the .NET 6 SDK accepts the same path-like IDs.

Per CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), the weakness is a product that uses external input to construct a pathname under a restricted directory without neutralizing elements that resolve outside it.

This issue affects the .NET 6 SDK on Windows, including the End-of-Life .NET 6.0 line covered by NES. Exposure requires a local attacker who can influence a workload manifest and a user who runs an elevated dotnet workload command. Application runtimes are not affected.

Details

Module Info

• Product: .NET SDK
• Affected packages: .NET SDK workload installation and advertising manifests
• Affected versions:
  
  • .NET SDK >= 6.0.100 <= 6.0.437 (Windows)
• Package manager: Windows Installer, archives (.zip)
• GitHub repository: https://github.com/dotnet/sdk
• Published packages: Download .NET (Linux, macOS, and Windows)
• Fixed in:
  
  • NES for .NET 6.0.47 (.NET SDK 6.0.438)

Vulnerability Info

This High-severity vulnerability is found in how the .NET SDK reads workload manifests. A manifest names workloads, workload packs and the manifest itself by ID, and the SDK uses those IDs to build folder names, for example under the packs directory, where SDK-type packs are imported as MSBuild SDKs. In the 6.0 SDK the IDs were barely validated: WorkloadId rejected only null or empty strings, WorkloadPackId only null or whitespace, and ManifestId only null. An ID shaped like a relative path could therefore point outside the intended directory, and an elevated workload operation could end up importing MSBuild targets the attacker placed there.

The fix requires every workload, pack and manifest ID to be a single valid path component. A manifest with a bad ID is rejected with a WorkloadManifestFormatException, and a bad ID on the dotnet workload install or uninstall command line is reported as an unrecognized workload. CVE-2026-70161 and CVE-2026-70190 were reported separately and are addressed together by the same workload hardening in NES for .NET 6.0.47.

This vulnerability has been present since at least .NET SDK 6.0.

Mitigation

.NET 6 is End-of-Life and will not receive any updates from Microsoft to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a supported .NET SDK, one of:
  
  • .NET SDK 10.0.113 or later (10.0.1xx feature band)
  • .NET SDK 10.0.402 or later (10.0.4xx feature band)
• Avoid running dotnet workload commands elevated on machines where untrusted users can write to %ProgramData%\dotnet until patched.
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.47 (.NET SDK 6.0.438) or later.

Credits

The following researchers, as credited in Microsoft's advisory:

• Omar Khaleel (@omarkhalil1138)
• Nguyen Van Minh Duc with Saigon Newport Corporation
• Nguyen Hoang Quoc An with Lien Phat Technology Corporation
• kayiz with Lien Phat Technology Corporation
• Aobo Wang (@m4x_1997)