{"id":"CVE-2026-125753","kind":"vulnerability","aliases":["CVE-2026-125753"],"related":[],"title":"ABP Framework: path traversal lets unauthenticated users read server files","description":"ABP Framework 2.9.0 before 10.6.2 and 10.7.0 pre-releases before 10.7.0 contain a path traversal vulnerability in DefaultBlobFilePathCalculator that allows unauthenticated attackers to access files outside the blob container. Attackers can send %5C-encoded backslashes through the Blogging api/blogging/files/{name} endpoint on Windows hosts to read files like appsettings.json containing signing keys and connection strings.","summary":"ABP Framework's blob file path calculator fails to block traversal sequences, so attackers can read files outside the blob container. Through the Blogging files endpoint on Windows hosts, an unauthenticated attacker can read files such as appsettings.json, which can expose signing keys and connection strings.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["abp-framework","blogging-module","dotnet","package","windows"],"not_affected_if":["blogging-module-absent","non-windows-host"],"how_to_check":"- Check the ABP Framework version in your project's package references; affected versions are 2.9.0 before 10.6.2 and 10.7.0 pre-releases before 10.7.0.\n- Check whether the Blogging module is installed and whether `api/blogging/files/{name}` is reachable on a Windows host.","fix":"- Move ABP Framework to `10.6.2` or later on the 10.6 line, or to `10.7.0` or later.","status":"open","published_at":"2026-11-10T16:17:22+00:00","first_seen_at":"2026-11-10T16:22:34+00:00","triaged_at":"2026-11-10T16:23:24+00:00","updated_at":"2026-11-10T16:23:24+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-10T16:23:24Z","model":"claude-haiku-5-5","output":{"fix":"- Move ABP Framework to `10.6.2` or later on the 10.6 line, or to `10.7.0` or later.","reach":"internet","title":"ABP Framework: path traversal lets unauthenticated users read server files","impact":"high","summary":"ABP Framework's blob file path calculator fails to block traversal sequences, so attackers can read files outside the blob container. Through the Blogging files endpoint on Windows hosts, an unauthenticated attacker can read files such as appsettings.json, which can expose signing keys and connection strings.","audience":"developers","category":"package","nicknames":[],"who_cares":["abp-framework","dotnet","windows","blogging-module"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Secrets such as signing keys and connection strings are readable by attackers","analyst_note":"Confirm the exact fixed version for the 2.9.x line and check the vendor advisory for whether the Blogging module is required for exposure.","how_to_check":"- Check the ABP Framework version in your project's package references; affected versions are 2.9.0 before 10.6.2 and 10.7.0 pre-releases before 10.7.0.\n- Check whether the Blogging module is installed and whether `api/blogging/files/{name}` is reachable on a Windows host.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["non-windows-host","blogging-module-absent"],"who_is_affected":"Applications built on ABP Framework 2.9.0 through the pre-10.7.0 releases that include the Blogging module and run on Windows hosts. The exposed route is the Blogging file endpoint, which accepts %5C-encoded backslashes; applications without that module or not hosted on Windows are not described as affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000791,"input_tokens":4682,"output_tokens":645,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125753':13A,16A '-2026':12A,15A '10.6.2':76C '10.7.0':78C,83C '2.9.0':74C '5c':106C '5c-encoded':105C 'abp':1A,18B,26B,72C 'abp-framework':17B 'access':96C 'allow':92C 'api/blogging/files':112C 'appsettings.json':63B,122C 'attack':39B,57B,94C,102C 'backslash':108C 'blob':29B,45B,100C 'block':35B 'blog':21B,49B,111C 'blogging-modul':20B 'calcul':32B 'connect':70B,127C 'contain':46B,84C,101C,123C 'cve':11A,14A 'defaultblobfilepathcalcul':90C 'dotnet':23B 'encod':107C 'endpoint':51B,114C 'expos':66B 'fail':33B 'file':10A,30B,42B,50B,60B,97C,120C 'framework':2A,19B,27B,73C 'host':54B,117C 'key':68B,125C 'let':5A 'like':121C 'modul':22B 'name':113C 'outsid':43B,98C 'packag':24B 'path':3A,31B,86C 'pre':80C 'pre-releas':79C 'read':8A,41B,59B,119C 'releas':81C 'send':104C 'sequenc':37B 'server':9A 'sign':67B,124C 'string':71B,128C 'travers':4A,36B,87C 'unauthent':6A,56B,93C 'user':7A 'vulner':88C 'window':25B,53B,116C","nicknames":[],"mitigations":[],"who_affected":"Applications built on ABP Framework 2.9.0 through the pre-10.7.0 releases that include the Blogging module and run on Windows hosts. The exposed route is the Blogging file endpoint, which accepts %5C-encoded backslashes; applications without that module or not hosted on Windows are not described as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["abpframework","bloggingmodule","dotnet","high","package","windows"],"campaign_type":null,"search_a":"'-125753':13A,16A '-2026':12A,15A 'abp':1A 'cve':11A,14A 'file':10A 'framework':2A 'let':5A 'path':3A 'read':8A 'server':9A 'travers':4A 'unauthent':6A 'user':7A","search_b":"'abp':18B,26B 'abp-framework':17B 'appsettings.json':63B 'attack':39B,57B 'blob':29B,45B 'block':35B 'blog':21B,49B 'blogging-modul':20B 'calcul':32B 'connect':70B 'contain':46B 'dotnet':23B 'endpoint':51B 'expos':66B 'fail':33B 'file':30B,42B,50B,60B 'framework':19B,27B 'host':54B 'key':68B 'modul':22B 'outsid':43B 'packag':24B 'path':31B 'read':41B,59B 'sequenc':37B 'sign':67B 'string':71B 'travers':36B 'unauthent':56B 'window':25B,53B","search_c":"'10.6.2':76C '10.7.0':78C,83C '2.9.0':74C '5c':106C '5c-encoded':105C 'abp':72C 'access':96C 'allow':92C 'api/blogging/files':112C 'appsettings.json':122C 'attack':94C,102C 'backslash':108C 'blob':100C 'blog':111C 'connect':127C 'contain':84C,101C,123C 'defaultblobfilepathcalcul':90C 'encod':107C 'endpoint':114C 'file':97C,120C 'framework':73C 'host':117C 'key':125C 'like':121C 'name':113C 'outsid':98C 'path':86C 'pre':80C 'pre-releas':79C 'read':119C 'releas':81C 'send':104C 'sign':124C 'string':128C 'travers':87C 'unauthent':93C 'vulner':88C 'window':116C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-08T14:04:42+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125753","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125753","severity":null,"published_at":"2026-11-10T16:17:22+00:00","modified_at":"2026-11-10T16:17:22+00:00","first_seen_at":"2026-11-10T16:22:34+00:00","fetched_at":"2026-11-10T16:22:34+00:00","note":null}],"documents":[{"id":116121,"url":"https://github.com/abpframework/abp/commit/a25442ec688927a87b74a0403667dce84c88abc5","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":116122,"url":"https://github.com/abpframework/abp/security/advisories/GHSA-4x2h-f4f8-xjr6","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-08T14:04:42+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":116123,"url":"https://www.vulncheck.com/advisories/abp-framework-before-10.6.2-and-10.7.0-path-traversal-via-blogging-file-endpoints","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}