# CVE-2026-77173: Document file format confidentiality marking bypass with hash character in filename

Source: https://junglewise.ai/threats/cve-2026-77173-a-user-could-create-a-docx-or-odt-file-with-a-in-the-filename  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-77173 · Severity: medium · CVSS 4.3 · Published 2026-10-27

A software application fails to mark files as confidential when they contain sensitive information like credit card numbers if the filename includes a hash character (#). An attacker could exploit this to create confidential documents that are not properly flagged as sensitive, potentially allowing unauthorized access or exposure of protected data.

Technologies: [<UNKNOWN>](https://junglewise.ai/threats/technologies/x-unknown).

## Quick answers

**Is CVE-2026-77173 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77173 being exploited in the wild.

**How severe is CVE-2026-77173?** Medium severity, with a CVSS score of 4.3, published 27 October 2026.

**Which products and versions are affected?** <UNKNOWN>.

**Is there a fix for CVE-2026-77173?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-77173 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-77173?** Check whether you run <UNKNOWN>. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a confidentiality marking bypass in document handling where files in DOCX or ODT format fail to be marked as confidential when their filenames contain a hash character. This is a filename-parsing issue where special characters (specifically #) prevent proper classification of documents containing sensitive data. The flaw requires user action to create or manipulate the file, and exposes sensitive information by circumventing access control classifications.

## Affected products

- <UNKNOWN>

## Timeline

- 2026-10-27: disclosed

## References

- [https://hackerone.com/reports/3682163](https://hackerone.com/reports/3682163)

## Related threats

- [System component denial of service vulnerability](https://junglewise.ai/threats/cve-2026-95784-a-vulnerability-exists-in-a-system-component-that-may-under)
- [Hessian remoting authentication bypass with non-root context path](https://junglewise.ai/threats/cve-2026-97874-when-hessian-remoting-is-configured-with-basic-authentication-the)
- [Embedded server weak session ID generation](https://junglewise.ai/threats/cve-2026-111259-the-embedded-server-generates-http-session-identifiers-with-a)
- [Web application request routing security constraint bypass](https://junglewise.ai/threats/cve-2026-111258-the-optional-request-routing-feature-forwards-requests-to-their)
- [SSH administration service authentication bypass](https://junglewise.ai/threats/cve-2026-111239-the-optional-ssh-administration-service-grants-full-access-to)