CVE-2008-5026: Microsoft SharePoint uses URLs with the same hostname and port number for a web site's primary files and in...

Security readout for executives and security teams

This issue concerns older Microsoft SharePoint behavior where uploaded user files could share the same browser origin as trusted site content. An authenticated user who can upload HTML could potentially make that file run script in a trusted SharePoint context. The record does not provide CVSS, affected versions, a patch, or evidence of active exploitation. Exposure is most relevant to legacy SharePoint deployments that allow authenticated users to upload HTML or similar browser-rendered attachments under the same hostname and port as trusted site content. Treat as a legacy exposure review item, not an emergency based on supplied evidence. Prioritize if older SharePoint systems remain internet-accessible or broad internal users can upload HTML files. Mitigation focus: Check Microsoft or SharePoint-specific guidance for historical fixes or configuration changes.; Avoid allowing untrusted users to upload browser-rendered HTML where feasible.; Separate user-uploaded files from trusted site content by origin if supported..

Prepared

Jun 28, 2026, 18:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.