CVE-2026-85953: CWE-22: Improper Limitation of a Pathname to a Restricted Directory in Progress Software Corporation MarkLogic Server

CVE-2026-85953 affects Progress Software Corporation's MarkLogic Server in versions >=11.0.0 <11.3.7 and >=12.0.0 <12.1.0. The vulnerability arises from privileged legacy InfoStudio modules that do not properly validate user-controlled file paths and user-context values. This improper validation can lead to unauthorized access to server files or execution of actions under an unintended identity, representing a privilege escalation and path traversal issue. The CVSS 3.1 score is 8.5, indicating high severity, with network attack vector, low attack complexity, and privileges required but no user interaction needed. The impact includes high confidentiality loss and low integrity loss without availability impact.

Successful exploitation could allow an attacker with some privileges to access sensitive server files or execute operations under an unintended identity, potentially leading to unauthorized data disclosure and limited integrity compromise. There is no indication of availability impact. The vulnerability affects confidentiality and integrity of the system.

No explicit patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is applied, restrict access to the affected modules and monitor for suspicious activity related to file path usage and privilege escalation attempts.