---
id: "CVE-2026-125753"
page: "https://infrastack.ai/live/CVE-2026-125753"
kind: "vulnerability"
aliases: ["CVE-2026-125753"]
title: "ABP Framework: path traversal lets unauthenticated users read server files"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["abp-framework", "blogging-module", "dotnet", "package", "windows"]
not_affected_if: ["blogging-module-absent", "non-windows-host"]
published_at: "2026-11-10T16:17:22+00:00"
first_seen_at: "2026-11-10T16:22:34+00:00"
updated_at: "2026-11-10T16:23:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125753", "first_seen_at": "2026-11-10T16:22:34+00:00"}]
exploit_sources: []
---

# ABP Framework: path traversal lets unauthenticated users read server files

Link for people: https://infrastack.ai/live/CVE-2026-125753 (this .md is for agents)

ABP Framework's blob file path calculator fails to block traversal sequences, so attackers can read files outside the blob container. Through the Blogging files endpoint on Windows hosts, an unauthenticated attacker can read files such as appsettings.json, which can expose signing keys and connection strings.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the ABP Framework version in your project's package references; affected versions are 2.9.0 before 10.6.2 and 10.7.0 pre-releases before 10.7.0.
- Check whether the Blogging module is installed and whether `api/blogging/files/{name}` is reachable on a Windows host.

## Fix

- Move ABP Framework to `10.6.2` or later on the 10.6 line, or to `10.7.0` or later.

## Timeline

- 2026-11-10T16:22:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125753

## Documents

- [advisory] Vendor advisory: github.com https://github.com/abpframework/abp/security/advisories/GHSA-4x2h-f4f8-xjr6
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/abp-framework-before-10.6.2-and-10.7.0-path-traversal-via-blogging-file-endpoints
- [fix] Patch: github.com https://github.com/abpframework/abp/commit/a25442ec688927a87b74a0403667dce84c88abc5

## From the sources

ABP Framework 2.9.0 before 10.6.2 and 10.7.0 pre-releases before 10.7.0 contain a path traversal vulnerability in DefaultBlobFilePathCalculator that allows unauthenticated attackers to access files outside the blob container. Attackers can send %5C-encoded backslashes through the Blogging api/blogging/files/{name} endpoint on Windows hosts to read files like appsettings.json containing signing keys and connection strings.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_