SharePoint Products ApS has released CopyMove updates to stop malicious ZIP entry paths from writing files outside their intended extraction directory. The November 6 security advisory covers CopyMove for SharePoint V6 and CopyMove for SharePoint 2019 on Windows.
CopyMove is a third-party add-on for copying and moving SharePoint content. The vendor’s download page maps its current branches to on-premises SharePoint Server Subscription Edition and SharePoint Server 2019. Administrators should identify the installed CopyMove branch as well as the SharePoint environment before choosing an installer.
ZIP import permissions are part of the attack conditions
The official CVE record for CVE-2026-123973 describes an authenticated SharePoint user with the permissions needed to use ZIP import submitting a crafted archive. During extraction, manipulated paths can cause writes outside the designated folder. That establishes a path traversal and file-write issue; the published description does not demonstrate remote code execution.
The MITRE record assigns a CVSS 3.1 score of 5.0, rated medium, with low privileges and user interaction required. The practical exposure therefore depends on access to the import function, rather than simply the presence of a SharePoint website.
Install the fix for the correct branch
The vendor identifies these affected ranges and fixed builds:
CopyMove V6: 6.0.0.0 through versions below 6.3.1.2094; fixed in 6.3.1.2094. CopyMove for SharePoint 2019: 5.0.0.0 through versions below 5.2.1.2095; fixed in 5.2.1.2095.
The correction validates archive entry paths before extraction. Until the appropriate update is installed, the vendor recommends limiting ZIP import to trusted users and avoiding archives from untrusted sources. These restrictions are interim controls while the vulnerable installation is updated.
The vendor page still labels the CVE assignment as pending. The official CVE record was published on November 6 at 17:49 UTC and supplies the identifier used here.
