{"id":"CVE-2026-125753","summary":"ABP Framework before 10.6.2 and 10.7.0 Path Traversal via Blogging File Endpoints","details":"ABP Framework 2.9.0 before 10.6.2 and 10.7.0 pre-releases before 10.7.0 contain a path traversal vulnerability in DefaultBlobFilePathCalculator that allows unauthenticated attackers to access files outside the blob container. Attackers can send %5C-encoded backslashes through the Blogging api/blogging/files/{name} endpoint on Windows hosts to read files like appsettings.json containing signing keys and connection strings.","aliases":["GHSA-4x2h-f4f8-xjr6"],"modified":"2026-11-11T02:48:12.535395477Z","published":"2026-11-10T15:22:48.656Z","database_specific":{"cwe_ids":["CWE-22"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/125xxx/CVE-2026-125753.json","cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/125xxx/CVE-2026-125753.json"},{"type":"PACKAGE","url":"https://github.com/abpframework/abp"},{"type":"ARTICLE","url":"https://github.com/abpframework/abp/blob/10.6.1/framework/src/Volo.Abp.BlobStoring.FileSystem/Volo/Abp/BlobStoring/FileSystem/DefaultBlobFilePathCalculator.cs#L35"},{"type":"FIX","url":"https://github.com/abpframework/abp/commit/a25442ec688927a87b74a0403667dce84c88abc5"},{"type":"FIX","url":"https://github.com/abpframework/abp/pull/26232"},{"type":"ADVISORY","url":"https://github.com/abpframework/abp/security/advisories/GHSA-4x2h-f4f8-xjr6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125753"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/abp-framework-before-10.6.2-and-10.7.0-path-traversal-via-blogging-file-endpoints"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/abpframework/abp","events":[{"introduced":"44dcd4ce2f24b692e93bb564e2e06a7afc9ed93c"},{"fixed":"9007a3af87132973c57a78c478e1f4c8318b883f"},{"introduced":"d9ae95d2dee9d35167ca0adc1a625b47497ceeeb"},{"fixed":"c68e856d06615c6bd512b0649c10a4dc45af33e6"},{"introduced":"3cada55df00b1cbff63ed9f8999239df720ac4a9"},{"fixed":"9007a3af87132973c57a78c478e1f4c8318b883f"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"2.9.0"},{"fixed":"10.6.2"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"strategy":"StandardRange","range":[{"introduced":"10.7.0-rc.1"},{"fixed":"10.7.0"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"0.14.0"},{"fixed":"10.6.2"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"}]}}],"versions":["10.7.0-rc.5","10.6.1","10.7.0-rc.4","10.7.0-rc.3","10.7.0-rc.2","10.7.0-rc.1","10.6.0","10.6.0-rc.3","10.6.0-rc.2","10.6.0-rc.1","archive/patch-1-engincanv","archive/before-net10","archive/issue-23231-v2","archive/feature/logo-provider","v9.2.0-preview","archive/issue-5384","archive/abp-united-pre-merge","archive/halil-presentation-2024-05","archive/devnot-demo","2.9.0","4.1.0-rc.1","4.0.0-rc.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-125753.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}