Skip to content
Heist/ feed
Back to feed
Critical

Path traversal in Sandboxie

Type: advisorySources: OSV

Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. An authenticated user (**UserA**) with no privileges is authorized to read all files created in sandbox belonging to other users in the sandbox folders `C:\Sandbox\UserB\xxx`. An authenticated attacker who can use `explorer.exe` or `cmd.exe` outside any sandbox can read other users' files in `C:\Sandbox\xxx`. By default in Windows 7+, the `C:\Users\UserA` folder is not readable by **UserB**. All files edited or created during the sandbox processing are affected by the vulnerability. All files in C:\Users are safe. If `UserB` runs a cmd in a sandbox, he will be able to access `C:\Sandox\UserA`. In addition, if **UserB** create a folder `C:\Sandbox\UserA` with malicious ACLs, when **UserA** will user the sandbox, Sandboxie doesn't reset ACLs ! This issue has not yet been fixed. Users are advised to limit access to their systems using Sandboxie.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2024-49360
Confirmed fixed CVEs
Not specified
Updated in this feed
6 Nov 2026, 02:10 UTC · Revision 1

Source evidence

Path traversal in Sandboxie

core-osv · Original source

Published 29 Nov 2024, 18:11 UTC

Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. An authenticated user (**UserA**) with no privileges is authorized to read all files created in sandbox belonging to other users in the sandbox folders `C:\Sandbox\UserB\xxx`. An authenticated attacker who can use `explorer.exe` or `cmd.exe` outside any sandbox can read other users' files in `C:\Sandbox\xxx`. By default in Windows 7+, the `C:\Users\UserA` folder is not readable by **UserB**. All files edited or created during the sandbox processing are affected by the vulnerability. All files in C:\Users are safe. If `UserB` runs a cmd in a sandbox, he will be able to access `C:\Sandox\UserA`. In addition, if **UserB** create a folder `C:\Sandbox\UserA` with malicious ACLs, when **UserA** will user the sandbox, Sandboxie doesn't reset ACLs ! This issue has not yet been fixed. Users are advised to limit access to their systems using Sandboxie.

osv:CVE-2024-49360
Complete source record
{
  "id": "c93b6614d27665d1ce00e51ae64630089aa3efef3fdf26bf8ecc666c13d12ded",
  "url": "https://osv.dev/vulnerability/CVE-2024-49360",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Path traversal in Sandboxie",
    "summary": "Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. An authenticated user (**UserA**) with no privileges is authorized to read all files created in sandbox belonging to other users in the sandbox folders `C:\\Sandbox\\UserB\\xxx`. An authenticated attacker who can use `explorer.exe` or `cmd.exe` outside any sandbox can read other users' files in `C:\\Sandbox\\xxx`. By default in Windows 7+, the `C:\\Users\\UserA` folder is not readable by **UserB**. All files edited or created during the sandbox processing are affected by the vulnerability. All files in C:\\Users are safe. If `UserB` runs a cmd in a sandbox, he will be able to access `C:\\Sandox\\UserA`. In addition, if **UserB** create a folder `C:\\Sandbox\\UserA` with malicious ACLs, when **UserA** will user the sandbox, Sandboxie doesn't reset ACLs ! This issue has not yet been fixed. Users are advised to limit access to their systems using Sandboxie.",
    "evidence": "osv:CVE-2024-49360",
    "products": [],
    "severity": "critical",
    "structured": {
      "id": "CVE-2024-49360",
      "aliases": [
        "CVE-2024-49360",
        "GHSA-4chj-3c28-gvmp"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/sandboxie-plus/sandboxie",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "cbb1e23366674105ebcbc769a9a0f9743b047cd1"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:sandboxie-plus:sandboxie:*:*:*:*:plus:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.14.6"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.14.5",
            "v1.14.4",
            "v1.14.3",
            "v1.14.1",
            "v1.14.0",
            "v1.13.7",
            "v1.13.6",
            "v1.13.5",
            "v1.13.4",
            "v1.13.3",
            "v1.13.2",
            "v1.13.1",
            "v1.13.0",
            "v1.12.9",
            "v1.12.8",
            "v1.12.7",
            "v1.12.6",
            "v1.12.5",
            "v1.12.4",
            "v1.12.3",
            "v1.12.2",
            "v1.12.1",
            "v1.12.0",
            "v1.11.4",
            "v1.11.3",
            "v1.11.2",
            "v1.11.1",
            "v1.11.0",
            "v1.10.5",
            "v1.10.4",
            "v1.10.3",
            "v1.10.2",
            "v1.10.1",
            "v1.9.8",
            "v1.9.7",
            "v1.9.6",
            "v1.9.4",
            "v1.9.3",
            "v1.9.1",
            "v1.9.0",
            "v1.8.4",
            "v1.8.3",
            "v1.8.2a",
            "v1.8.2",
            "v1.8.1",
            "v1.8.0",
            "v1.7.2",
            "v1.7.1",
            "v1.7.0",
            "v1.6.7",
            "v1.6.6",
            "v1.6.5",
            "v1.6.4",
            "v1.6.3",
            "v1.6.2b",
            "v1.6.1b",
            "v1.6.1a",
            "v1.6.1",
            "v1.6.0",
            "v1.5.3",
            "v1.5.2",
            "v1.5.1",
            "v1.5.0",
            "v1.4.2",
            "v1.4.1",
            "v1.4.0",
            "v1.3.5",
            "1.3.4",
            "v1.3.3",
            "v1.3.2",
            "v1.3.1",
            "v1.3.0",
            "v1.2.9",
            "v1.2.8",
            "v1.2.7",
            "v1.2.6",
            "v1.2.4",
            "v1.2.3",
            "v1.2.2",
            "v1.2.1",
            "v1.1.3",
            "v1.1.2",
            "1.1.0",
            "1.0.22",
            "1.0.20",
            "1.0.19",
            "1.0.18",
            "1.0.17",
            "1.0.16",
            "1.0.15",
            "1.0.14",
            "1.0.13",
            "1.0.12",
            "1.0.11",
            "1.0.10",
            "1.0.8",
            "1.0.6",
            "1.0.5",
            "1.0.4",
            "1.0.3",
            "1.0.2",
            "1.0.1",
            "1.0.0",
            "0.9.8d",
            "0.9.8c",
            "0.9.8",
            "0.9.7e",
            "0.9.7d",
            "0.9.7c",
            "0.9.7b",
            "0.9.7",
            "0.9.6",
            "0.9.5",
            "0.9.4",
            "0.9.3",
            "0.9.2",
            "0.9.1",
            "0.9.0a",
            "0.8.8",
            "0.8.7b",
            "0.8.7",
            "0.8.6",
            "0.8.5",
            "0.8.2",
            "0.8.0",
            "0.8.1",
            "0.7.5",
            "0.7.4",
            "0.7.3",
            "0.7.2",
            "0.7.1",
            "0.7.0",
            "0.6.7",
            "0.6.5",
            "0.6.0",
            "0.5.5",
            "v0.5.4d",
            "v0.5.4c",
            "v0.5.4b",
            "v0.5.4",
            "v0.5.3b",
            "v0.5.3a",
            "v0.5.2",
            "v0.5.1",
            "v0.5.0",
            "v0.4.5",
            "v0.4.4",
            "v0.4.3",
            "v0.4.2",
            "v0.4.1",
            "v0.4.0",
            "v0.3.5",
            "v0.3",
            "v0.2.2",
            "v0.2.1",
            "v0.2",
            "v0.1",
            "v5.40.1",
            "v5.40"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-49360.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:46.212231984Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/49xxx/CVE-2024-49360.json",
        "https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-4chj-3c28-gvmp",
        "https://nvd.nist.gov/vuln/detail/CVE-2024-49360"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-22"
        ],
        "cna_assigner": "GitHub_M",
        "unresolved_ranges": [
          {
            "extracted_events": [
              {
                "range": [
                  {
                    "introduced": "< v1.14.6 / 5.69.6"
                  },
                  {
                    "last_affected": "< v1.14.6 / 5.69.6"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StandaloneSingleVersion"
              }
            ]
          }
        ],
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/49xxx/CVE-2024-49360.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2024-49360",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 514156,
  "published_at": "2024-11-29T18:11:58.261+00:00"
}