CVE-2008-5026
Microsoft SharePoint uses URLs with the same hostname and port number for a web site's primary...
Microsoft SharePoint uses URLs with the same hostname and port number for a web site's primary files and individual users' uploaded files (aka attachments), which allows remote authenticated users to leverage same-origin relationships and conduct cross-site scripting (XSS) attacks by uploading HTML documents.
Exploit likelihood
What each source reports
NVD Score used
Microsoft SharePoint uses URLs with the same hostname and port number for a web site's primary files and individual users' uploaded files (aka attachments), which allows remote authenticated users to leverage same-origin relationships and conduct cross-site scripting (XSS) attacks by uploading HTML documents.
- Record
CVE-2008-5026- CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Microsoft SharePoint uses URLs with the same hostname and port number for a web site's primary files and individual users' uploaded files (aka attachments), which allows remote authenticated users to leverage same-origin relationships and conduct cross-site scripting (XSS) attacks by uploading HTML documents.
- Record
CVE-2008-5026- Updated
- 2026-11-02
EUVDEUVD-2008-5005 No score
Microsoft SharePoint uses URLs with the same hostname and port number for a web site's primary files and individual users' uploaded files (aka attachments), which allows remote authenticated users to leverage same-origin relationships and conduct cross-site scripting (XSS) attacks by uploading HTML documents.
- Record
EUVD-2008-5005- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-97xr-fxpc-2qp6 No score
Microsoft SharePoint uses URLs with the same hostname and port number for a web site's primary...
Microsoft SharePoint uses URLs with the same hostname and port number for a web site's primary files and individual users' uploaded files (aka attachments), which allows remote authenticated users to leverage same-origin relationships and conduct cross-site scripting (XSS) attacks by uploading HTML documents.
- Record
GHSA-97xr-fxpc-2qp6- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-5026 is a low vulnerability (CVSS 3.5) in Microsoft Sharepoint Server, published November 10, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 9.38%, the 95th percentile. No source names a fixed version.
References
archives.neohapsis.com/archives/bugtraq/2008-11/0056.html
exchange.xforce.ibmcloud.com/vulnerabilities/46590
pomcor.com/whitepapers/file_sharing_security.pdf
nvd.nist.gov/vuln/detail/CVE-2008-5026
github.com/advisories/GHSA-97xr-fxpc-2qp6