CVE-2026-125753
ABP Framework before 10.6.2 and 10.7.0 Path Traversal via Blogging File Endpoints
CVSS Score
5.9
EPSS Score
0.0%
EPSS Percentile
0th
ABP Framework 2.9.0 before 10.6.2 and 10.7.0 pre-releases before 10.7.0 contain a path traversal vulnerability in DefaultBlobFilePathCalculator that allows unauthenticated attackers to access files outside the blob container. Attackers can send %5C-encoded backslashes through the Blogging api/blogging/files/{name} endpoint on Windows hosts to read files like appsettings.json containing signing keys and connection strings.
| CWE | CWE-22 |
| Vendor | abpframework |
| Product | abp |
| Published | Nov 10, 2026 |
| Last Updated | Nov 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for abpframework abp
Be the first to know when new medium vulnerabilities affecting abpframework abp are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
abpframework / abp
2.9.0 < 10.6.2 10.7.0-rc.1 < 10.7.0
abpframework / abp
0.14.0 < 10.6.2 10.7.0-rc.1 < 10.7.0
References
github.com: https://github.com/abpframework/abp/security/advisories/GHSA-4x2h-f4f8-xjr6 github.com: https://github.com/abpframework/abp/pull/26232 github.com: https://github.com/abpframework/abp/commit/a25442ec688927a87b74a0403667dce84c88abc5 github.com: https://github.com/abpframework/abp/blob/10.6.1/framework/src/Volo.Abp.BlobStoring.FileSystem/Volo/Abp/BlobStoring/FileSystem/DefaultBlobFilePathCalculator.cs#L35 vulncheck.com: https://www.vulncheck.com/advisories/abp-framework-before-10.6.2-and-10.7.0-path-traversal-via-blogging-file-endpoints
Credits
Nguyen Le Thanh Nam (yuwkaa)