CVE-2024-33880: Virtosoftware SharePoint Bulk File Download

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. It discloses full pathnames via Virto.SharePoint.FileDownloader/Api/Download.ashx?action=archive.

Affected products

Published 2024-06-24. Last modified 2026-06-17.