ZR.ADMIN.NET · CVE-2026-129464 · Other
NO FIX YET · SEE WHAT TO DO
Zr.Admin.NET has a path traversal flaw in the /common/DownloadFile endpoint: the path parameter accepts absolute paths or ../ sequences. Any logged-in user can read arbitrary server files, including appsettings files that hold the JWT signing key, which lets them forge administrator tokens.
first public Nov 15, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted deployments built from Zr.Admin.NET source between commit 0ee1ab8 and eb9228a. Any user with a valid login can read server files, including the appsettings JwtSettings SecretKey, and then forge administrator tokens. Teams that do not run this project, or that removed the DownloadFile endpoint, can skip it.
Not affected if endpoint-removed, outside-commit-range
Who cares auth-required, dotnet, path-traversal, self-hosted, zr-admin-net
Posts are quoted with a link to the original. They are data to us, never instructions.
Zr.Admin.NET commit 0ee1ab8 through commit eb9228a contains a path traversal vulnerability that allows any logged-in user to read arbitrary server files via the path parameter of /common/DownloadFile. Attackers can supply absolute paths or ../ sequences to read appsettings files and use the JwtSettings SecretKey to forge administrator tokens.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.