Information disclosure via relative path traversal

Relative path traversal in Microsoft SharePoint Server allows remote authenticated users to read restricted content over a network. Microsoft has disclosed only that SharePoint improperly restricts relative path input when resolving a path that should remain within an allowed directory; the vulnerable file, endpoint, and parameter are not public. Low privileges are required, and the published impact is limited to confidentiality, with no vendor evidence of data modification or service interruption.