CVE-2026-125753 · Package
NO FIX YET · SEE WHAT TO DO
ABP Framework's blob file path calculator fails to block traversal sequences, so attackers can read files outside the blob container. Through the Blogging files endpoint on Windows hosts, an unauthenticated attacker can read files such as appsettings.json, which can expose signing keys and connection strings.
first public Oct 8, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications built on ABP Framework 2.9.0 through the pre-10.7.0 releases that include the Blogging module and run on Windows hosts. The exposed route is the Blogging file endpoint, which accepts %5C-encoded backslashes; applications without that module or not hosted on Windows are not described as affected.
Not affected if blogging-module-absent, non-windows-host
Who cares abp-framework, blogging-module, dotnet, windows
api/blogging/files/{name} is reachable on a Windows host.10.6.2 or later on the 10.6 line, or to 10.7.0 or later.ABP Framework 2.9.0 before 10.6.2 and 10.7.0 pre-releases before 10.7.0 contain a path traversal vulnerability in DefaultBlobFilePathCalculator that allows unauthenticated attackers to access files outside the blob container. Attackers can send %5C-encoded backslashes through the Blogging api/blogging/files/{name} endpoint on Windows hosts to read files like appsettings.json containing signing keys and connection strings.
This page as .md ·
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.