CVE-2026-16444— Improper Validation of File Paths in TeamViewer Desktop Clients
Quick assessment
Affected
TeamViewer Full Client, Host, QuickSupport & Portable
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 TeamViewer 桌面客户端版本低于 15.81.5 中，存在对路径遍历序列处理不当的问题。经过身份验证的远程会话参与者可以通过文件传输或虚拟文件剪贴板机制，将文件写入本地文件系统上的非预期位置。攻击者可利用此行为实现任意文件写入，并可能以受影响用户的权限执行代码。
Affected Version Matrix 8
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| TeamViewer | Full Client, Host, QuickSupport (v13 for Linux) | 13.0< 13.2.153978 |
affected |
| TeamViewer | Full Client, Host, QuickSupport (v13 for macOS) | 13.0< 13.2.153981 |
affected |
| TeamViewer | Full Client, Host, QuickSupport (v14 for Linux) | 14.0< 14.7.48838 |
affected |
| TeamViewer | Full Client, Host, QuickSupport (v14 for macOS) | 14.0< 14.7.48838 |
affected |
| TeamViewer | Full Client, Host, QuickSupport (v14 for Windows) | 14.0< 14.7.48833 |
affected |
| TeamViewer | Full Client, Host, QuickSupport & Portable | 15.0< 15.81.5 |
affected |
| TeamViewer | Full Client, Host, QuickSupport & Portable (for Windows 7 & 8) | 15.64.0< 15.64.7 |
affected |
| TeamViewer | Full Client, Host, QuickSupport & Portable (v13 for Windows) | 13.0< 13.2.36229 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-16444
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Improper Validation of File Paths in TeamViewer Desktop Clients
Source: CVE Program / CVE List V5
Vulnerability Description
Improper
neutralization of path traversal sequences in TeamViewer Desktop Clients prior
Version 15.81.5 allows an authenticated remote session participant to write files
to unintended locations on the local file system via file transfer or virtual
file clipboard mechanisms. An attacker can leverage this behavior to achieve
arbitrary file write and potentially execute code with the privileges of the
affected user.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
文件名或路径的外部可控制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| TeamViewer | Full Client, Host, QuickSupport & Portable | 15.0 ~ 15.81.5 | - |
|
| TeamViewer | Full Client, Host, QuickSupport & Portable (for Windows 7 & 8) | 15.64.0 ~ 15.64.7 | - |
|
| TeamViewer | Full Client, Host, QuickSupport (v14 for Windows) | 14.0 ~ 14.7.48833 | - |
|
| TeamViewer | Full Client, Host, QuickSupport (v14 for Linux) | 14.0 ~ 14.7.48838 | - |
|
| TeamViewer | Full Client, Host, QuickSupport (v14 for macOS) | 14.0 ~ 14.7.48838 | - |
|
| TeamViewer | Full Client, Host, QuickSupport & Portable (v13 for Windows) | 13.0 ~ 13.2.36229 | - |
|
| TeamViewer | Full Client, Host, QuickSupport (v13 for Linux) | 13.0 ~ 13.2.153978 | - |
|
| TeamViewer | Full Client, Host, QuickSupport (v13 for macOS) | 13.0 ~ 13.2.153981 | - |
|
II. Public POCs for CVE-2026-16444
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-16444
请登录查看更多情报信息。
Other References for CVE-2026-16444 (1)
IV. Related Vulnerabilities
Same vendor: TeamViewer
-
CVE-2026-19042
Command Injection in TeamViewer Desktop Client for Linux thr -
CVE-2026-12703
Bypass of 2FA for Connections via Unattended Access in TeamV -
CVE-2026-8381
Broken Access Control in TeamViewer DEX Platform (On Premise -
CVE-2026-2695
Lack of Server-side validation in Instruction Input in TeamV -
CVE-2026-23572
Improper Access Control in TeamViewer clients
Same weakness: CWE-73
-
CVE-2026-59683
OpenRGB: local and remote system compromise via arbitrary fi -
CVE-2026-59682
Arbitrary file overwrite and deletion local and remote in Op -
CVE-2026-55609
sublinear-time-solver: Arbitrary file write in consciousness -
CVE-2026-79674
NLTK 3.10.2 Path Traversal via corpus-reader constructors -
CVE-2026-78679
GitPython before 3.1.59 Arbitrary File Read via TagReference
V. Comments for CVE-2026-16444
No comments yet