Path Traversal in Abpframework Abp
CVE-2026-125753
ABP Framework 2.9.0 before 10.6.2 and 10.7.0 pre-releases before 10.7.0 contain a path traversal vulnerability in DefaultBlobFilePathCalculator that allows unauthenticated attackers to access files outside the blob container. Attackers can send %5C-encoded backslashes through the Blogging api/blogging/files/{name} endpoint on Windows hosts to read files like appsettings.json containing signing keys and connection strings.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
FIRST.org has not scored this CVE yet. About EPSS.
Affected products
Weakness classification (CWE)
Public exploits and proof-of-concept code
1 public repository with exploit or proof-of-concept code for this CVE:
- yuwkaaa/CVE-2026-125753 (last pushed 2026-11-11): CVE-2026-125753 — path traversal out of the blob container in ABP Framework
References
- github.com/abpframework/abp/security/advisories/GHSA-4x2h-f4f8-xjr6 (vendor-advisory)
- github.com/abpframework/abp/pull/26232 (issue-tracking, patch)
- github.com/abpframework/abp/commit/a25442ec688927a87b74a0403667dce84c88abc5 (patch)
- github.com/abpframework/abp/blob/10.6.1/framework/src/Volo.Abp.BlobStoring.File… (technical-description)
- www.vulncheck.com/advisories/abp-framework-before-10.6.2-and-10.7.0-path-traver… (third-party-advisory)
This CVE has public exploit evidence. See the latest CVEs with public exploits.