{"id":"CVE-2026-125753","published":"2026-11-10T16:17:22.307","lastModified":"2026-11-10T17:17:31.043","description":"ABP Framework 2.9.0 before 10.6.2 and 10.7.0 pre-releases before 10.7.0 contain a path traversal vulnerability in DefaultBlobFilePathCalculator that allows unauthenticated attackers to access files outside the blob container. Attackers can send %5C-encoded backslashes through the Blogging api/blogging/files/{name} endpoint on Windows hosts to read files like appsettings.json containing signing keys and connection strings.","cvssScore":5.9,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://github.com/abpframework/abp/blob/10.6.1/framework/src/Volo.Abp.BlobStoring.FileSystem/Volo/Abp/BlobStoring/FileSystem/DefaultBlobFilePathCalculator.cs#L35","tags":[]},{"url":"https://github.com/abpframework/abp/commit/a25442ec688927a87b74a0403667dce84c88abc5","tags":[]},{"url":"https://github.com/abpframework/abp/pull/26232","tags":[]},{"url":"https://github.com/abpframework/abp/security/advisories/GHSA-4x2h-f4f8-xjr6","tags":[]},{"url":"https://www.vulncheck.com/advisories/abp-framework-before-10.6.2-and-10.7.0-path-traversal-via-blogging-file-endpoints","tags":[]}],"exploitRefs":[{"url":"https://github.com/abpframework/abp/blob/10.6.1/framework/src/Volo.Abp.BlobStoring.FileSystem/Volo/Abp/BlobStoring/FileSystem/DefaultBlobFilePathCalculator.cs#L35","tags":[]},{"url":"https://github.com/abpframework/abp/commit/a25442ec688927a87b74a0403667dce84c88abc5","tags":[]},{"url":"https://github.com/abpframework/abp/pull/26232","tags":[]},{"url":"https://github.com/abpframework/abp/security/advisories/GHSA-4x2h-f4f8-xjr6","tags":[]}],"hasPoc":true,"ai":null}