A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard…
Affects Microsoft Security Response Center MicrosoftSource GCVE Database
Not known to be exploited · CVSS 3.6 Low.
Data as of 10/25/2026, 12:14:15 UTC
- Exploitation
Not in CISA KEV, no exploitation reported
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Microsoft Security Response Center Microsoft | Affected
| Fixed in– |
Description
A vulnerability in the Node.js permission model for filesystem enforcement allows access to paths that do not match a specified wildcard pattern. This flaw could lead to unauthorized access to filesystem paths beyond intended restrictions. The issue is identified in Microsoft-related software, specifically version 3.0. No CVSS score or detailed exploit information is currently available.
Impact
The vulnerability could allow unauthorized access to filesystem paths that should be restricted by wildcard-based permission checks. This may lead to exposure or modification of sensitive files or directories that are outside the intended access scope. No further impact details or exploitation reports are available.
Summary
CVE-2026-106071 describes a flaw in the Node.js permission model's filesystem enforcement mechanism where access can be granted to filesystem paths that do not conform to the expected wildcard restrictions. This vulnerability is categorized under CWE-284 (Improper Access Control). The affected product is Microsoft software version 3.0. No patch or remediation details have been provided, and there are no known exploits in the wild at this time.
Weaknesses
- CWE-284Improper Access Control (opens in a new tab)
Pillar weaknessCWE Top 25 (2025): #19OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.