---
id: "CVE-2026-129464"
page: "https://infrastack.ai/live/CVE-2026-129464"
kind: "vulnerability"
aliases: ["CVE-2026-129464"]
title: "Zr.Admin.NET: path traversal lets any logged-in user read server files"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Zr.Admin.NET", "fixed": [], "affected": ">= 0ee1ab8af5e3861766746d25acba1184111befcb, <= eb9228a23014f6000c06cab2f10ae0d44ecbbd3a", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["auth-required", "dotnet", "other", "path-traversal", "self-hosted", "zr-admin-net"]
not_affected_if: ["endpoint-removed", "outside-commit-range"]
published_at: "2026-11-15T02:17:21+00:00"
first_seen_at: "2026-11-15T02:35:07+00:00"
updated_at: "2026-11-15T02:36:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129464", "first_seen_at": "2026-11-15T02:35:07+00:00"}, {"source": "analyst", "url": "https://github.com/izhaorui/Zr.Admin.NET/issues/27", "first_seen_at": "2026-11-15T02:36:57+00:00", "cites": ["https://github.com/izhaorui/Zr.Admin.NET/issues/27"]}]
exploit_sources: []
---

# Zr.Admin.NET: path traversal lets any logged-in user read server files

Link for people: https://infrastack.ai/live/CVE-2026-129464 (this .md is for agents)

Zr.Admin.NET has a path traversal flaw in the /common/DownloadFile endpoint: the path parameter accepts absolute paths or ../ sequences. Any logged-in user can read arbitrary server files, including appsettings files that hold the JWT signing key, which lets them forge administrator tokens.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Zr.Admin.NET affected >= 0ee1ab8af5e3861766746d25acba1184111befcb, <= eb9228a23014f6000c06cab2f10ae0d44ecbbd3a fixed no fixed version listed

## How to check

Check whether your Zr.Admin.NET source includes CommonController.DownloadFile (commit 0ee1ab8, Dec 2023, through eb9228a). Test with a normal user token: GET /common/DownloadFile?path=../appsettings.json. If it returns file content you are exposed. If so, rotate JwtSettings:SecretKey and treat any admin token as forgeable.

## Fix

No fixed release or patch commit found. Issue #27 on the maintainer's repo is open (2026-11-14). Commit 0ee1ab8 (2023-12-16) is the commit that added the download endpoint, not a fix. Until the maintainer patches it, block or remove /common/DownloadFile and rotate JwtSettings SecretKey if you were exposed.

## Timeline

- 2026-11-15T02:35:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129464
- 2026-11-15T02:36:57+00:00 analyst https://github.com/izhaorui/Zr.Admin.NET/issues/27 — VulnCheck advisory and open GitHub issue #27 read; no fix exists. The doc linked as 'fix' (0ee1ab8) is the commit that introduced the endpoint; the relation is wrong. PoC not public as far as seen. Not exploited.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/zr-admin-net-commit-0ee1ab8-through-eb9228a-path-traversal-via-downloadfile
- [describes] Zr.Admin.NET issue #27: 5 vulnerabilities (open) https://github.com/izhaorui/Zr.Admin.NET/issues/27
- [fix] Patch: github.com https://github.com/izhaorui/Zr.Admin.NET/commit/0ee1ab8af5e3861766746d25acba1184111befcb

## From the sources

Zr.Admin.NET commit 0ee1ab8 through commit eb9228a contains a path traversal vulnerability that allows any logged-in user to read arbitrary server files via the path parameter of /common/DownloadFile. Attackers can supply absolute paths or ../ sequences to read appsettings files and use the JwtSettings SecretKey to forge administrator tokens.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_