A path traversal vulnerability exists in the ZIP import functionality of SharePoint Products ApS CopyMove for SharePoint 2019 and CopyMove for SharePoint V6. An authenticated user with permission to use the ZIP import can supply a crafted ZIP archive with malicious paths that cause files to be extracted outside the intended directory. This vulnerability allows unauthorized file writes outside the designated extraction folder. The issue has been addressed by adding validation of ZIP archive entry paths to prevent such traversal.