{"id":"CVE-2026-129464","kind":"vulnerability","aliases":["CVE-2026-129464"],"related":[],"title":"Zr.Admin.NET: path traversal lets any logged-in user read server files","description":"Zr.Admin.NET commit 0ee1ab8 through commit eb9228a contains a path traversal vulnerability that allows any logged-in user to read arbitrary server files via the path parameter of /common/DownloadFile. Attackers can supply absolute paths or ../ sequences to read appsettings files and use the JwtSettings SecretKey to forge administrator tokens.","summary":"Zr.Admin.NET has a path traversal flaw in the /common/DownloadFile endpoint: the path parameter accepts absolute paths or ../ sequences. Any logged-in user can read arbitrary server files, including appsettings files that hold the JWT signing key, which lets them forge administrator tokens.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Zr.Admin.NET","fixed":[],"affected":">= 0ee1ab8af5e3861766746d25acba1184111befcb, <= eb9228a23014f6000c06cab2f10ae0d44ecbbd3a","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["auth-required","dotnet","other","path-traversal","self-hosted","zr-admin-net"],"not_affected_if":["endpoint-removed","outside-commit-range"],"how_to_check":"Check whether your Zr.Admin.NET source includes CommonController.DownloadFile (commit 0ee1ab8, Dec 2023, through eb9228a). Test with a normal user token: GET /common/DownloadFile?path=../appsettings.json. If it returns file content you are exposed. If so, rotate JwtSettings:SecretKey and treat any admin token as forgeable.","fix":"No fixed release or patch commit found. Issue #27 on the maintainer's repo is open (2026-11-14). Commit 0ee1ab8 (2023-12-16) is the commit that added the download endpoint, not a fix. Until the maintainer patches it, block or remove /common/DownloadFile and rotate JwtSettings SecretKey if you were exposed.","status":"open","published_at":"2026-11-15T02:17:21+00:00","first_seen_at":"2026-11-15T02:35:07+00:00","triaged_at":"2026-11-15T02:36:27+00:00","updated_at":"2026-11-15T02:36:57+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-15T02:36:27Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Zr.Admin.NET: path traversal lets any logged-in user read server files","impact":"high","summary":"Zr.Admin.NET has a path traversal flaw in the /common/DownloadFile endpoint: the path parameter accepts absolute paths or ../ sequences. Any logged-in user can read arbitrary server files, including appsettings files that hold the JWT signing key, which lets them forge administrator tokens.","audience":"businesses","category":"other","nicknames":[],"who_cares":["zr-admin-net","dotnet","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"server secrets readable, admin tokens forgeable, full takeover possible","analyst_note":"Confirm the fixed version and any setting change from the GitHub patch at github.com and the VulnCheck advisory.","how_to_check":"- Check whether your deployment includes Zr.Admin.NET code between commit `0ee1ab8` and commit `eb9228a`.\n- Confirm whether the `/common/DownloadFile` endpoint is reachable by ordinary logged-in users.\n- unknown","plain_action":"","product_name":"Zr.Admin.NET","needs_analyst":true,"not_affected_if":["outside-commit-range"],"who_is_affected":"Teams running Zr.Admin.NET builds from commit 0ee1ab8 through eb9228a are exposed to any account holder who can call the file download endpoint. Installs that do not include this range, or that restrict who can log in, are less exposed. The sources do not state which deployment configurations are most at risk.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000773,"input_tokens":4625,"output_tokens":621,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and any setting change from the GitHub patch at github.com and the VulnCheck advisory.","search":"'-129464':15A,18A '-2026':14A,17A '/common/downloadfile':43B,106C '0ee1ab8':80C 'absolut':49B,110C 'accept':48B 'admin':33B 'administr':76B,125C 'allow':90C 'appset':64B,116C 'arbitrari':60B,98C 'attack':107C 'auth':21B 'auth-requir':20B 'commit':79C,82C 'contain':84C 'cve':13A,16A 'dotnet':23B 'eb9228a':83C 'endpoint':44B 'file':12A,62B,65B,100C,117C 'flaw':40B 'forg':75B,124C 'hold':67B 'host':30B 'includ':63B 'jwt':69B 'jwtset':121C 'key':71B 'let':4A,73B 'log':7A,55B,93C 'logged-in':6A,54B,92C 'net':34B 'paramet':47B,104C 'path':2A,26B,38B,46B,50B,86C,103C,111C 'path-travers':25B 'read':10A,59B,97C,115C 'requir':22B 'secretkey':122C 'self':29B 'self-host':28B 'sequenc':52B,113C 'server':11A,61B,99C 'sign':70B 'suppli':109C 'token':77B,126C 'travers':3A,27B,39B,87C 'use':119C 'user':9A,57B,95C 'via':101C 'vulner':88C 'zr':32B 'zr-admin-net':31B 'zr.admin.net':1A,19A,35B,78C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted deployments built from Zr.Admin.NET source between commit 0ee1ab8 and eb9228a. Any user with a valid login can read server files, including the appsettings JwtSettings SecretKey, and then forge administrator tokens. Teams that do not run this project, or that removed the DownloadFile endpoint, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["zradminnet"],"ptokens":["admin","net","zr"],"labels":["authrequired","dotnet","high","other","pathtraversal","selfhosted","vendor","zradminnet"],"campaign_type":null,"search_a":"'-129464':15A,18A '-2026':14A,17A 'cve':13A,16A 'file':12A 'let':4A 'log':7A 'logged-in':6A 'path':2A 'read':10A 'server':11A 'travers':3A 'user':9A 'zr.admin.net':1A,19A","search_b":"'/common/downloadfile':43B 'absolut':49B 'accept':48B 'admin':33B 'administr':76B 'appset':64B 'arbitrari':60B 'auth':21B 'auth-requir':20B 'dotnet':23B 'endpoint':44B 'file':62B,65B 'flaw':40B 'forg':75B 'hold':67B 'host':30B 'includ':63B 'jwt':69B 'key':71B 'let':73B 'log':55B 'logged-in':54B 'net':34B 'paramet':47B 'path':26B,38B,46B,50B 'path-travers':25B 'read':59B 'requir':22B 'self':29B 'self-host':28B 'sequenc':52B 'server':61B 'sign':70B 'token':77B 'travers':27B,39B 'user':57B 'zr':32B 'zr-admin-net':31B 'zr.admin.net':35B","search_c":"'/common/downloadfile':106C '0ee1ab8':80C 'absolut':110C 'administr':125C 'allow':90C 'appset':116C 'arbitrari':98C 'attack':107C 'commit':79C,82C 'contain':84C 'eb9228a':83C 'file':100C,117C 'forg':124C 'jwtset':121C 'log':93C 'logged-in':92C 'paramet':104C 'path':86C,103C,111C 'read':97C,115C 'secretkey':122C 'sequenc':113C 'server':99C 'suppli':109C 'token':126C 'travers':87C 'use':119C 'user':95C 'via':101C 'vulner':88C 'zr.admin.net':78C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T02:17:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129464","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129464","severity":null,"published_at":"2026-11-15T02:17:21+00:00","modified_at":"2026-11-15T02:17:21+00:00","first_seen_at":"2026-11-15T02:35:07+00:00","fetched_at":"2026-11-15T02:35:07+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-129464:4015","url":"https://github.com/izhaorui/Zr.Admin.NET/issues/27","severity":null,"published_at":"2026-11-15T02:36:57+00:00","modified_at":"2026-11-15T02:36:57+00:00","first_seen_at":"2026-11-15T02:36:57+00:00","fetched_at":"2026-11-15T02:36:57+00:00","note":"VulnCheck advisory and open GitHub issue #27 read; no fix exists. The doc linked as 'fix' (0ee1ab8) is the commit that introduced the endpoint; the relation is wrong. PoC not public as far as seen. Not exploited.","cites":["https://github.com/izhaorui/Zr.Admin.NET/issues/27"]}],"documents":[{"id":160179,"url":"https://github.com/izhaorui/Zr.Admin.NET/commit/0ee1ab8af5e3861766746d25acba1184111befcb","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":160180,"url":"https://www.vulncheck.com/advisories/zr-admin-net-commit-0ee1ab8-through-eb9228a-path-traversal-via-downloadfile","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":160184,"url":"https://github.com/izhaorui/Zr.Admin.NET/issues/27","title":"Zr.Admin.NET issue #27: 5 vulnerabilities (open)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}